The vulnerability CVE-2026-13551 affects itsourcecode Baptism Information Management System 1.0. It is caused by improper sanitization of the ID argument in the /editBaptism.php file, allowing an attacker to perform SQL injection attacks remotely without any privileges or user interaction. The vulnerability has been publicly disclosed, but no official fix or patch is currently documented. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to the limited scope of the vulnerability and the low complexity of the attack. There is no indication of widespread exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint and applying web application firewall rules to detect and block SQL injection attempts targeting the ID parameter in /editBaptism.php.