The vulnerability CVE-2026-13550 affects itsourcecode Baptism Information Management System version 1.0. It is a SQL injection flaw in an unspecified function in the /delbaptism.php file. Attackers can remotely exploit this by manipulating the ID argument, potentially allowing unauthorized database queries. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. No official fix or remediation level has been published as of now.

Successful exploitation of this SQL injection vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion. The impact is rated medium based on the CVSS score, reflecting limited but significant risk to data confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint, applying web application firewall rules to detect and block SQL injection attempts, and monitoring for suspicious activity related to the /delbaptism.php file. Avoid exposing the application to untrusted networks if possible.