Is there a public PoC exploit available for EUVD-2026-25751?

Yes, a public proof-of-concept exploit is available for EUVD-2026-25751. Prioritise patching immediately. EPSS: 0.0%.

itsourcecode Construction Management System EUVD-2026-25751

Q: What is the CVSS score of EUVD-2026-25751?

EUVD-2026-25751 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7074 MEDIUM

SQL Injection (CWE-89)

2026-04-27 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 27, 2026 - 02:30 vuln.today

Severity Changed

Apr 27, 2026 - 02:22 NVD

HIGH MEDIUM

CVSS changed

Apr 27, 2026 - 02:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 02:15 euvd

EUVD-2026-25751

Analysis Generated

Apr 27, 2026 - 02:15 vuln.today

CVE Published

Apr 27, 2026 - 01:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability has been found in itsourcecode Construction Management System 1.0. This vulnerability affects unknown code of the file /execute1.php. Such manipulation of the argument code leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in itsourcecode Construction Management System 1.0 allows remote unauthenticated attackers to manipulate the code parameter in /execute1.php, enabling database query manipulation and potential data exfiltration or modification. Publicly available exploit code exists, increasing real-world risk despite the moderate CVSS score of 6.9.

Technical ContextAI

The vulnerability resides in /execute1.php, a PHP application endpoint that processes user-supplied input via the code parameter without proper input validation or parameterized queries. CWE-89 (SQL Injection) indicates that untrusted user input is directly concatenated into SQL query strings, bypassing database access controls. The application likely uses direct string concatenation instead of prepared statements or parameterized queries, a common architectural flaw in older PHP applications. The CPE cpe:2.3:a:itsourcecode:construction_management_system:*:*:*:*:*:*:*:* indicates the vulnerability affects all versions of the construction management system product line.

RemediationAI

No vendor-released patch has been identified at time of analysis. Immediate mitigation requires updating to a patched version if available from https://itsourcecode.com/, or implementing input validation and parameterized queries in the /execute1.php file to prevent SQL injection. As a compensating control, restrict network access to /execute1.php through Web Application Firewall (WAF) rules that block requests containing SQL metacharacters (single quotes, semicolons, comment sequences) in the code parameter; this reduces exploitability but may block legitimate requests if the code parameter legitimately uses such characters. Alternatively, implement database user privilege restrictions so the application database account can only SELECT data without INSERT, UPDATE, DELETE, or DROP permissions, limiting the impact of successful SQL injection to data disclosure rather than data modification or deletion. Contact itsourcecode directly at https://itsourcecode.com/ to request a security patch or confirmation of remediation steps.