CVE-2026-108926
6.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Authenticated remote attackers can read or modify the database via SQL injection. Exploitation requires valid low-privileged credentials and access to the web interface.
Root cause
The ID parameter in ebaptism.php is concatenated directly into SQL queries without sanitization or parameterization.
Affected systems
itsourcecode Baptism Information Management System 1.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No official patch is available; restrict network access to ebaptism.php or place a web application firewall rule in front of it to block SQL injection payloads targeting the ID parameter.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown part of the file ebaptism.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.