Is there a public PoC exploit available for CVE-2026-6190?

Yes, a public proof-of-concept exploit is available for CVE-2026-6190. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6190

Q: What is the CVSS score of CVE-2026-6190?

CVE-2026-6190 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-22018 LOW

SQL Injection (CWE-89)

2026-04-13 VulDB

GHSA-x9rc-hqj2-wh76

PHP SQLi Construction Management System Itsourcecode

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 13, 2026 - 17:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 13, 2026 - 17:15 vuln.today

EUVD ID Assigned

Apr 13, 2026 - 16:45 euvd

EUVD-2026-22018

Analysis Generated

Apr 13, 2026 - 16:45 vuln.today

CVE Published

Apr 13, 2026 - 16:15 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was found in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /employees.php. Performing a manipulation of the argument Name results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Name parameter in /employees.php, resulting in confidentiality, integrity, and authenticity breaches. The vulnerability requires low-privilege authentication and has publicly available exploit code, elevating practical risk despite the moderate CVSS score of 6.3.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) flaw in a PHP-based construction management application. The /employees.php endpoint fails to properly sanitize or parameterize the Name parameter before incorporating it into SQL queries. The CPE indicates all versions of itsourcecode Construction Management System are affected. This is a common pattern in older PHP applications that do not use prepared statements or ORM frameworks, allowing an authenticated attacker to craft malicious SQL syntax that executes unintended database operations beyond the application's intended logic.

RemediationAI

Organizations using itsourcecode Construction Management System should immediately contact the vendor at https://itsourcecode.com/ to obtain a patched version; no specific patched release version is currently confirmed in available data. As an interim measure, restrict network access to /employees.php to authorized administrators only, enforce strong database access controls, and implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the Name parameter (e.g., detection of SQL keywords, quote escaping, comment syntax). Database activity monitoring should be enabled to detect anomalous query patterns. Code review and remediation should prioritize conversion to parameterized SQL queries or prepared statements in the affected endpoint.