Is there a public PoC exploit available for CVE-2026-7075?

Yes, a public proof-of-concept exploit is available for CVE-2026-7075. Prioritise patching immediately. EPSS: 0.0%.

itsourcecode Construction Management System CVE-2026-7075

Q: What is the CVSS score of CVE-2026-7075?

CVE-2026-7075 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25753 MEDIUM

SQL Injection (CWE-89)

2026-04-27 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 27, 2026 - 02:30 vuln.today

Severity Changed

Apr 27, 2026 - 02:22 NVD

HIGH MEDIUM

CVSS changed

Apr 27, 2026 - 02:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 02:15 euvd

EUVD-2026-25753

Analysis Generated

Apr 27, 2026 - 02:15 vuln.today

CVE Published

Apr 27, 2026 - 01:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in itsourcecode Construction Management System 1.0. This issue affects some unknown processing of the file /locations.php. Performing a manipulation of the argument address results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in itsourcecode Construction Management System 1.0 allows remote unauthenticated attackers to manipulate the address parameter in /locations.php, enabling arbitrary database queries with confidentiality and integrity impact. Publicly available exploit code exists, increasing real-world risk despite the moderate CVSS score of 6.9.

Technical ContextAI

The vulnerability stems from improper input validation in a PHP-based web application. The /locations.php file processes user-supplied data from the address parameter without adequate parameterized queries or sanitization, enabling SQL injection (CWE-89). The affected product is identified by CPE cpe:2.3:a:itsourcecode:construction_management_system:*:*:*:*:*:*:*:*, indicating all versions of the construction management system are potentially vulnerable. The CVSS 4.0 vector shows a network attack vector with no complexity requirements and no privilege escalation needed, typical of direct web input vulnerabilities in PHP applications.

RemediationAI

Immediate action is required: contact itsourcecode directly via https://itsourcecode.com/ to obtain a patched version, as no specific fix version number is documented in current public disclosures. Until a vendor patch is released, implement parameterized SQL queries (prepared statements) in the /locations.php file, specifically for the address parameter processing. Additionally, restrict direct access to /locations.php via web server configuration (nginx location block or Apache .htaccess), implement input validation to reject SQL metacharacters from address fields, and deploy a Web Application Firewall (WAF) rule set to detect and block SQL injection patterns targeting this endpoint. Enable database query logging to audit any suspicious activity, and limit database user privileges to the minimum required for the application (principle of least privilege). Monitor for exploitation attempts in web server logs for requests containing SQL keywords or special characters in the address parameter.