Is there a public PoC exploit available for CVE-2026-7073?

Yes, a public proof-of-concept exploit is available for CVE-2026-7073. Prioritise patching immediately. EPSS: 0.0%.

itsourcecode Construction Management System CVE-2026-7073

Q: What is the CVSS score of CVE-2026-7073?

CVE-2026-7073 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25749 MEDIUM

SQL Injection (CWE-89)

2026-04-27 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 27, 2026 - 01:29 vuln.today

Severity Changed

Apr 27, 2026 - 01:22 NVD

HIGH MEDIUM

CVSS changed

Apr 27, 2026 - 01:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 01:15 euvd

EUVD-2026-25749

Analysis Generated

Apr 27, 2026 - 01:15 vuln.today

CVE Published

Apr 27, 2026 - 01:00 nvd

MEDIUM 5.5

DescriptionCVE.org

A flaw has been found in itsourcecode Construction Management System 1.0. This affects an unknown part of the file /execute.php. This manipulation of the argument code causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in itsourcecode Construction Management System 1.0 via the code parameter in /execute.php allows remote unauthenticated attackers to execute arbitrary SQL queries and potentially access or modify database contents. The vulnerability has a publicly available exploit and is confirmed to have a low confidentiality, integrity, and availability impact according to CVSS v4.0 scoring.

Technical ContextAI

The vulnerability stems from improper input validation in a PHP application endpoint (/execute.php) that processes user-supplied data in the code parameter without sufficient sanitization or parameterized query protection. This is a classic instance of CWE-89 (SQL Injection), where unsanitized user input is directly concatenated into SQL query construction. The itsourcecode Construction Management System, identified via CPE cpe:2.3:a:itsourcecode:construction_management_system:*:*:*:*:*:*:*:*, is a web-based PHP application; the lack of input filtering in the code argument allows attackers to inject arbitrary SQL syntax to manipulate database queries.

RemediationAI

Immediate mitigation requires upgrading itsourcecode Construction Management System to a patched version if available from the vendor at https://itsourcecode.com/. As no vendor-released patch version has been confirmed at this time of analysis, implement immediate compensating controls: (1) apply input validation and parameterized query libraries (prepared statements) to all database interactions in /execute.php, specifically the code parameter - validate that input conforms to expected format and escape all user-supplied data before SQL execution; (2) restrict network access to /execute.php using a Web Application Firewall (WAF) or network ACL to trusted IP ranges only, blocking public internet access; (3) deploy SQL query monitoring and logging to detect anomalous patterns; (4) implement principle of least privilege for the database service account used by the PHP application. Each mitigation has trade-offs: parameterized queries may require application code refactoring; WAF rules may block legitimate requests if tuned too strictly; monitoring adds overhead but does not prevent exploitation. Contact the vendor directly for patch availability and timeline.