Is there a public PoC exploit available for CVE-2026-6007?

Yes, a public proof-of-concept exploit is available for CVE-2026-6007. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6007

Q: What is the CVSS score of CVE-2026-6007?

CVE-2026-6007 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21299 LOW

SQL Injection (CWE-89)

2026-04-10 VulDB

PHP SQLi Construction Management System Itsourcecode

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 10, 2026 - 04:17 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 03:45 euvd

EUVD-2026-21299

Analysis Generated

Apr 10, 2026 - 03:45 vuln.today

CVE Published

Apr 10, 2026 - 03:15 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /del.php. The manipulation of the argument equipname results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the equipname parameter in /del.php, enabling data exfiltration, modification, and potential denial of service. Publicly available exploit code exists, and the vulnerability carries a CVSS score of 6.3 with confirmed exploitation potential (E:P rating).

Technical ContextAI

The vulnerability stems from improper input validation in a PHP-based web application (CPE: cpe:2.3:a:itsourcecode:construction_management_system:*:*:*:*:*:*:*:*). The /del.php file fails to sanitize or parameterize the equipname parameter before incorporating it into SQL queries, allowing attackers to inject malicious SQL syntax. This is a classic CWE-89 SQL injection flaw common in legacy PHP applications that do not use prepared statements or ORM frameworks. The construction management domain suggests this affects project tracking and asset management systems used by contractors and engineers.

RemediationAI

Immediate upgrade or patching from the vendor is the primary remediation; however, no patched version has been independently confirmed as available. Organizations should contact itsourcecode.com directly to request a security update addressing the SQL injection in /del.php. As a temporary mitigation, restrict access to /del.php through firewall or web application firewall (WAF) rules, implement input validation and parameterized queries (prepared statements) within the application code if source access is available, enforce the principle of least privilege for database accounts used by the application, and monitor for suspicious SQL syntax in application logs. The GitHub issue (https://github.com/ltranquility/submit/issues/8) contains proof-of-concept details and may provide community-contributed patches.