CVE-2026-5675

MediumCVSS 6.3/10Last modified Jul 24, 2026

Description

A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown part of the file /borrowed_tool.php of the component Parameter Handler. The manipulation of the argument emp results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2026
Last modified
Jul 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-567509.1Gitea Remember-Me Token Theft Not Invalidating Attacker SessionCVE-2026-567556.2Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package UploadCVE-2026-567586.5The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the CVE-2026-56767.3A vulnerability was identified in Totolink A8000R 5.9c.681_B20180413. This issue affects the function setLanguageCfg of the file /cgi-bin/csCVE-2026-567614.3hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html byCVE-2026-567625.3Hono before 4.12.12 does not validate cookie names on the write path in the setCookie(), serialize(), and serializeSigned() functions, allowCVE-2026-567634.8Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objectCVE-2026-567643.7Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string compaCVE-2026-567659.8Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, eCVE-2026-567668.8Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTCVE-2026-567678.8Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows aCVE-2026-567688.8Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to by
CVE-2026-5675: Medium severity, CVSS 6.3 | Vulnix