CVE-2026-108926: itsourcecode Baptism Information Management System ebaptism.php sql injection
A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown part of the file ebaptism.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be performed remotely, but the CVSS vector indicates that low-level privileges are required. No user interaction is required.
Is exploitation practical?
The attack complexity is low, and a public exploit has been released. Systems where a low-privileged user can reach ebaptism.php and control its ID argument are the relevant exposure.
What impact can successful exploitation have?
The reported impact includes low confidentiality, integrity, and availability effects. The flaw is classified as SQL injection, so it may allow unintended database operations through the affected ID argument.