Is there a public PoC exploit available for CVE-2026-13551?

Yes, a public proof-of-concept exploit is available for CVE-2026-13551. Prioritise patching immediately. EPSS: 0.3%.

Baptism Management System CVE-2026-13551

Q: What is the CVSS score of CVE-2026-13551?

CVE-2026-13551 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40057 MEDIUM

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-6fxr-4vv5-6r7f

PHP SQLi Baptism Information Management System Itsourcecode

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible SQLi with no auth or interaction required; all three impact dimensions rated Low, scoped to the application database with no change in scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 29, 2026 - 09:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jun 29, 2026 - 09:21 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in itsourcecode Baptism Information Management System 1.0. This affects an unknown function of the file /editBaptism.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in itsourcecode Baptism Information Management System 1.0 exposes database contents to remote unauthenticated attackers via the ID parameter in /editBaptism.php. A publicly available proof-of-concept exploit exists on GitHub, enabling data exfiltration or modification without any credentials or user interaction. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/E:P) confirms low-complexity remote exploitation with no special conditions required, and no vendor-released patch has been identified.

Technical ContextAI

The affected application is a PHP-based web system for managing ecclesiastical baptism records, available from itsourcecode.com. The root cause is CWE-89 (Improper Neutralization of Special Elements in an SQL Command): user-supplied input passed via the ID parameter to /editBaptism.php is concatenated into a backend SQL query without sanitization or parameterized binding, a classic deficiency in PHP applications not using PDO or MySQLi prepared statements. The CPE cpe:2.3:a:itsourcecode:baptism_information_management_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating all known releases are potentially affected, with version 1.0 explicitly confirmed by the reporter. The vulnerability is exposed through a standard HTTP request to an edit endpoint, requiring no special protocol or network position beyond HTTP/HTTPS reachability.

RemediationAI

No vendor-released patch has been identified at time of analysis - the fix version is unconfirmed from available data. Immediate compensating controls include restricting network access to any deployed instance behind an authenticated reverse proxy or VPN to eliminate unauthenticated internet exposure of /editBaptism.php. Deploying a web application firewall rule to block SQL metacharacters (single quotes, semicolons, SQL comment sequences --) on the ID parameter of /editBaptism.php will reduce automated exploitation risk, though WAF bypass is possible with crafted payloads. Database connection credentials used by the application should be scoped to least-privilege (SELECT/INSERT/UPDATE on only the application schema, no FILE or SUPER grants) to contain blast radius if exploitation occurs. Long-term, the application's SQL query construction in /editBaptism.php must be refactored to use PHP PDO prepared statements with bound parameters. Reference the public POC at https://github.com/Hh-176/CVE/issues/2 to confirm the exact payload surface when testing fixes.