Is CVE-2026-108926 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108926 being exploited in the wild.

How severe is CVE-2026-108926?

Medium severity, with a CVSS score of 6.3, published 12 October 2026.

How is CVE-2026-108926 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-108926?

Check whether you run Itsourcecode Baptism Information Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108926: itsourcecode Baptism Information Management System SQL injection in ebaptism.php

CVE-2026-108926 · Severity: medium · CVSS 6.3 · Published 2026-10-12

Baptism Information Management System is a PHP-based application for managing church baptism records. A SQL injection vulnerability in the ebaptism.php file allows unauthenticated remote attackers to inject malicious database queries via the ID parameter, enabling unauthorized database access, data theft, and modification of baptism records.

Technologies: Itsourcecode Baptism Information Management System. Vendors: Itsourcecode.

Quick answers

Is CVE-2026-108926 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108926 being exploited in the wild.
How severe is CVE-2026-108926?: Medium severity, with a CVSS score of 6.3, published 12 October 2026.
Which products and versions are affected?: Itsourcecode Baptism Information Management System 1.0.
Is there a fix for CVE-2026-108926?: No fixed version is recorded yet. Use prepared statements and parameter binding to separate SQL code from user input. Implement strict input validation to ensure the ID parameter matches expected numeric patterns. Minimize database user permissions to the minimum necessary for application operation. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108926 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-108926?: Check whether you run Itsourcecode Baptism Information Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Use prepared statements and parameter binding to separate SQL code from user input. Implement strict input validation to ensure the ID parameter matches expected numeric patterns. Minimize database user permissions to the minimum necessary for application operation.

Technical details

A SQL injection vulnerability exists in the /ebaptism.php file where the 'id' parameter is not properly sanitized before being used in SQL queries. Attackers can inject arbitrary SQL code through the ID parameter without authentication to extract sensitive data, modify records, or potentially gain system control. The vulnerability is exploitable remotely via HTTP GET requests.

Affected products

itsourcecode Baptism Information Management System 1.0

Timeline

2026-09-24: disclosed
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.