CVE-2026-108927
6.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Authenticated remote attackers can read, modify, or delete database contents via SQL injection. They only need low-privilege network access to reach the application.
Root cause
The application fails to sanitize or parameterize the 'b_id' input parameter in pbaptism.php before passing it into a database query.
Affected systems
itsourcecode Baptism Information Management System 1.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No official patched version is listed. Restrict network access to the web server or block requests containing the 'b_id' parameter to pbaptism.php at your reverse proxy or web application firewall until the code is patched.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unknown code of the file pbaptism.php. This manipulation of the argument b_id causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.