Is there a public PoC exploit available for CVE-2026-5620?

Yes, a public proof-of-concept exploit is available for CVE-2026-5620. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5620

Q: What is the CVSS score of CVE-2026-5620?

CVE-2026-5620 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19168 LOW

SQL Injection (CWE-89)

2026-04-06 VulDB

GHSA-j8r9-fj5r-fm7x

PHP SQLi Construction Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 04:45 euvd

EUVD-2026-19168

Analysis Generated

Apr 06, 2026 - 04:45 vuln.today

CVE Published

Apr 06, 2026 - 04:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability has been found in itsourcecode Construction Management System 1.0. Affected is an unknown function of the file /borrowed_equip_report.php of the component Parameter Handler. The manipulation of the argument Home leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Home parameter in /borrowed_equip_report.php, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, and demonstrates low attack complexity with network-based delivery requiring valid credentials.

Technical ContextAI

The vulnerability exists in a PHP-based parameter handler within the Construction Management System's report generation module. The /borrowed_equip_report.php file fails to properly sanitize or parameterize the Home parameter before incorporating it into SQL queries, creating a classic SQL injection point (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). The CPE cpe:2.3:a:itsourcecode:construction_management_system:*:*:*:*:*:*:*:* indicates the vulnerability affects the Construction Management System product family. Since the CVSS vector shows PR:L (requires Low privilege level), the attack requires an authenticated user session, limiting the immediate threat surface but still representing a significant privilege escalation or lateral movement vector within an organization using this application.

RemediationAI

Update to a patched version of itsourcecode Construction Management System if available from the vendor website https://itsourcecode.com/. No specific patch version number is independently confirmed from available vendor advisory data. As an interim mitigation, restrict access to the /borrowed_equip_report.php endpoint using network-level access controls, implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the Home parameter, and review and restrict user account privileges to the minimum necessary level. Implement parameterized queries and input validation for all user-supplied parameters in report generation functionality. Verify any available security updates from the vendor and apply promptly when released.