Is CVE-2026-5620 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5620 being exploited in the wild.

How severe is CVE-2026-5620?

Medium severity, with a CVSS score of 6.3, published 6 April 2026.

Is there a fix for CVE-2026-5620?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5620 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-5620?

Check whether you run Itsourcecode Construction Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5620: itsourcecode Construction Management System SQL injection in borrowed_equip_report.php

CVE-2026-5620 · Severity: medium · CVSS 6.3 · Published 2026-04-06

itsourcecode Construction Management System is a web application used for managing construction projects. A security vulnerability in the system's reporting component allows an attacker to interfere with the underlying database. If exploited, this could lead to the unauthorized viewing of sensitive project data, modification of records, or disruption of the management system's operations.

Technologies: Itsourcecode Construction Management System. Vendors: Itsourcecode.

Quick answers

Is CVE-2026-5620 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5620 being exploited in the wild.
How severe is CVE-2026-5620?: Medium severity, with a CVSS score of 6.3, published 6 April 2026.
Which products and versions are affected?: Itsourcecode Construction Management System 1.0.
Is there a fix for CVE-2026-5620?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5620 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-5620?: Check whether you run Itsourcecode Construction Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in itsourcecode Construction Management System 1.0 within the '/borrowed_equip_report.php' file. The root cause is the improper neutralization of special elements in the 'start' (and potentially 'Home') parameter handled by the application. An attacker with low-privileged user credentials can submit malicious SQL queries via a POST request to manipulate database operations. This can lead to unauthorized data extraction (via error-based or time-based blind techniques), data tampering, or service interruption. While some reports suggest no authentication is required, the primary technical analysis indicates the vulnerability is reachable after logging in with valid credentials. No official patch is currently available; users are advised to implement prepared statements and input validation.

Affected products

itsourcecode Construction Management System 1.0

Timeline

2026-03-22: disclosed: Initial disclosure on GitHub by researcher Qwh0729
2026-04-06: advisory: VulDB and NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.