Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-108922 (GCVE-0-2026-108922)

Vulnerability from nvd – Published: 2026-10-12 19:00 – Updated: 2026-10-15 13:39

Title

KusalkaSilva Learning-Management-System upload_save.php getimagesize unrestricted upload

Summary

A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is the function getimagesize of the file upload_save.php. Executing a manipulation of the argument uploaded_file/image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 13:39 UTC

CWE

CWE-434 - Unrestricted Upload
CWE-284 - Improper Access Controls

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3860 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/416735	vdb-entrytechnical-description
https://vuldb.com/vuln/416735/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108922	third-party-advisory
https://vuldb.com/submit/994384	third-party-advisory
https://github.com/KusalkaSilva/Learning-Manageme…	exploitissue-tracking
https://github.com/KusalkaSilva/Learning-Manageme…	product

Impacted products

1 product

Vendor	Product	Version
KusalkaSilva	Learning-Management-System	Affected: ffeb873f8803f1e9664384ff75000c7da45466d2 cpe:2.3:a:kusalkasilva:learning-management-system::::::::

Credits

vuldb2026 (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108922",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T13:39:43.481679Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T13:39:59.994Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
          ],
          "product": "Learning-Management-System",
          "vendor": "KusalkaSilva",
          "versions": [
            {
              "status": "affected",
              "version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "vuldb2026 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is the function getimagesize of the file upload_save.php. Executing a manipulation of the argument uploaded_file/image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "Unrestricted Upload",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Controls",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T19:00:11.131Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-416735 | KusalkaSilva Learning-Management-System upload_save.php getimagesize unrestricted upload",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/416735"
        },
        {
          "name": "VDB-416735 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/416735/cti"
        },
        {
          "name": "CVE-2026-108922 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-108922"
        },
        {
          "name": "Submit #994384 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 Unrestricted Upload",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/994384"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/6"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-11T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-11T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-11T19:35:28.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "KusalkaSilva Learning-Management-System upload_save.php getimagesize unrestricted upload",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-108922",
    "datePublished": "2026-10-12T19:00:11.131Z",
    "dateReserved": "2026-10-11T17:30:18.463Z",
    "dateUpdated": "2026-10-15T13:39:59.994Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108921 (GCVE-0-2026-108921)

Vulnerability from nvd – Published: 2026-10-12 18:45 – Updated: 2026-10-13 16:02

Title

KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication

Summary

A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_announcements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 16:02 UTC

CWE

CWE-306 - Missing Authentication
CWE-287 - Improper Authentication

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3860 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/416734	vdb-entrytechnical-description
https://vuldb.com/vuln/416734/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108921	third-party-advisory
https://vuldb.com/submit/994370	third-party-advisory
https://github.com/KusalkaSilva/Learning-Manageme…	exploitissue-tracking
https://github.com/KusalkaSilva/Learning-Manageme…	product

Impacted products

1 product

Vendor	Product	Version
KusalkaSilva	Learning-Management-System	Affected: ffeb873f8803f1e9664384ff75000c7da45466d2 cpe:2.3:a:kusalkasilva:learning-management-system::::::::

Credits

vuldb2026 (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108921",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T16:02:05.338476Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T16:02:16.429Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "State-Changing Endpoints"
          ],
          "product": "Learning-Management-System",
          "vendor": "KusalkaSilva",
          "versions": [
            {
              "status": "affected",
              "version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "vuldb2026 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_announcements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T18:45:15.546Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-416734 | KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/416734"
        },
        {
          "name": "VDB-416734 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/416734/cti"
        },
        {
          "name": "CVE-2026-108921 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-108921"
        },
        {
          "name": "Submit #994370 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 Missing Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/994370"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/5"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-11T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-11T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-11T19:35:24.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-108921",
    "datePublished": "2026-10-12T18:45:15.546Z",
    "dateReserved": "2026-10-11T17:30:13.900Z",
    "dateUpdated": "2026-10-13T16:02:16.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105921 (GCVE-0-2026-105921)

Vulnerability from nvd – Published: 2026-10-06 14:15 – Updated: 2026-10-06 14:50

Title

Kusalkasilva Learning-Management-System search_class.php sql injection

Summary

A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search_class.php. Such manipulation of the argument school_year leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 14:47 UTC

CWE

CWE-89 - SQL Injection
CWE-74 - Injection

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3860 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/413895	vdb-entrytechnical-description
https://vuldb.com/vuln/413895/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-105921	third-party-advisory
https://vuldb.com/submit/992659	third-party-advisory
https://github.com/KusalkaSilva/Learning-Manageme…	exploitissue-tracking
https://github.com/KusalkaSilva/Learning-Manageme…	product

Impacted products

1 product

Vendor	Product	Version
Kusalkasilva	Learning-Management-System	Affected: ffeb873f8803f1e9664384ff75000c7da45466d2 cpe:2.3:a:kusalkasilva:learning-management-system::::::::

Credits

Jameszhan783 (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105921",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T14:47:43.198439Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T14:50:14.844Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
          ],
          "product": "Learning-Management-System",
          "vendor": "Kusalkasilva",
          "versions": [
            {
              "status": "affected",
              "version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jameszhan783 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search_class.php. Such manipulation of the argument school_year leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T14:15:14.896Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413895 | Kusalkasilva Learning-Management-System search_class.php sql injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413895"
        },
        {
          "name": "VDB-413895 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413895/cti"
        },
        {
          "name": "CVE-2026-105921 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-105921"
        },
        {
          "name": "Submit #992659 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/992659"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/4"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-06T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-06T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-06T07:54:45.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Kusalkasilva Learning-Management-System search_class.php sql injection",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-105921",
    "datePublished": "2026-10-06T14:15:14.896Z",
    "dateReserved": "2026-10-06T05:49:28.053Z",
    "dateUpdated": "2026-10-06T14:50:14.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105920 (GCVE-0-2026-105920)

Vulnerability from nvd – Published: 2026-10-06 13:30 – Updated: 2026-10-09 00:59

Title

Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection

Summary

A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 00:58 UTC

CWE

CWE-89 - SQL Injection
CWE-74 - Injection

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3860 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/413894	vdb-entry
https://vuldb.com/vuln/413894/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-105920	third-party-advisory
https://vuldb.com/submit/992656	third-party-advisory
https://github.com/KusalkaSilva/Learning-Manageme…	exploitissue-tracking
https://github.com/KusalkaSilva/Learning-Manageme…	product

Impacted products

1 product

Vendor	Product	Version
Kusalkasilva	Learning-Management-System	Affected: ffeb873f8803f1e9664384ff75000c7da45466d2 cpe:2.3:a:kusalkasilva:learning-management-system::::::::

Credits

vuldb2026 (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105920",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T00:58:53.254521Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T00:59:05.177Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Student Registration Endpoint"
          ],
          "product": "Learning-Management-System",
          "vendor": "Kusalkasilva",
          "versions": [
            {
              "status": "affected",
              "version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "vuldb2026 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T13:30:11.719Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413894 | Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/413894"
        },
        {
          "name": "VDB-413894 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413894/cti"
        },
        {
          "name": "CVE-2026-105920 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-105920"
        },
        {
          "name": "Submit #992656 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/992656"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/3"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-06T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-06T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-06T07:54:41.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-105920",
    "datePublished": "2026-10-06T13:30:11.719Z",
    "dateReserved": "2026-10-06T05:49:24.622Z",
    "dateUpdated": "2026-10-09T00:59:05.177Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105919 (GCVE-0-2026-105919)

Vulnerability from nvd – Published: 2026-10-06 13:00 – Updated: 2026-10-06 17:12

Title

Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection

Summary

A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 17:11 UTC

CWE

CWE-89 - SQL Injection
CWE-74 - Injection

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3860 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/413893	vdb-entrytechnical-description
https://vuldb.com/vuln/413893/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-105919	third-party-advisory
https://vuldb.com/submit/992655	third-party-advisory
https://github.com/KusalkaSilva/Learning-Manageme…	exploitissue-tracking
https://github.com/KusalkaSilva/Learning-Manageme…	product

Impacted products

1 product

Vendor	Product	Version
Kusalkasilva	Learning-Management-System	Affected: ffeb873f8803f1e9664384ff75000c7da45466d2 cpe:2.3:a:kusalkasilva:learning-management-system::::::::

Credits

yinian328 (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105919",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T17:11:57.108209Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T17:12:29.497Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Administrator Login Endpoint"
          ],
          "product": "Learning-Management-System",
          "vendor": "Kusalkasilva",
          "versions": [
            {
              "status": "affected",
              "version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yinian328 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T13:00:15.810Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413893 | Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413893"
        },
        {
          "name": "VDB-413893 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413893/cti"
        },
        {
          "name": "CVE-2026-105919 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-105919"
        },
        {
          "name": "Submit #992655 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/992655"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/2"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-06T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-06T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-06T07:54:38.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-105919",
    "datePublished": "2026-10-06T13:00:15.810Z",
    "dateReserved": "2026-10-06T05:49:21.184Z",
    "dateUpdated": "2026-10-06T17:12:29.497Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105918 (GCVE-0-2026-105918)

Vulnerability from nvd – Published: 2026-10-06 11:45 – Updated: 2026-10-06 17:40

Title

Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection

Summary

A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 17:06 UTC

CWE

CWE-89 - SQL Injection
CWE-74 - Injection

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3860 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/413892	vdb-entrytechnical-description
https://vuldb.com/vuln/413892/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-105918	third-party-advisory
https://vuldb.com/submit/992654	third-party-advisory
https://github.com/KusalkaSilva/Learning-Manageme…	exploitissue-tracking
https://github.com/KusalkaSilva/Learning-Manageme…	product

Impacted products

1 product

Vendor	Product	Version
Kusalkasilva	Learning-Management-System	Affected: ffeb873f8803f1e9664384ff75000c7da45466d2 cpe:2.3:a:kusalkasilva:learning-management-system::::::::

Credits

yinian328 (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105918",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T17:06:36.935710Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T17:40:12.577Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Login Endpoint"
          ],
          "product": "Learning-Management-System",
          "vendor": "Kusalkasilva",
          "versions": [
            {
              "status": "affected",
              "version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yinian328 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T11:45:14.525Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413892 | Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413892"
        },
        {
          "name": "VDB-413892 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413892/cti"
        },
        {
          "name": "CVE-2026-105918 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-105918"
        },
        {
          "name": "Submit #992654 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/992654"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/1"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-06T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-06T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-06T07:54:34.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-105918",
    "datePublished": "2026-10-06T11:45:14.525Z",
    "dateReserved": "2026-10-06T05:49:17.217Z",
    "dateUpdated": "2026-10-06T17:40:12.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108922 (GCVE-0-2026-108922)

Vulnerability from cvelistv5 – Published: 2026-10-12 19:00 – Updated: 2026-10-15 13:39

Title

KusalkaSilva Learning-Management-System upload_save.php getimagesize unrestricted upload

Summary

A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is the function getimagesize of the file upload_save.php. Executing a manipulation of the argument uploaded_file/image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 13:39 UTC

CWE

CWE-434 - Unrestricted Upload
CWE-284 - Improper Access Controls

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3860 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/416735	vdb-entrytechnical-description
https://vuldb.com/vuln/416735/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108922	third-party-advisory
https://vuldb.com/submit/994384	third-party-advisory
https://github.com/KusalkaSilva/Learning-Manageme…	exploitissue-tracking
https://github.com/KusalkaSilva/Learning-Manageme…	product

Impacted products

1 product

Vendor	Product	Version
KusalkaSilva	Learning-Management-System	Affected: ffeb873f8803f1e9664384ff75000c7da45466d2 cpe:2.3:a:kusalkasilva:learning-management-system::::::::

Credits

vuldb2026 (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108922",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T13:39:43.481679Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T13:39:59.994Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
          ],
          "product": "Learning-Management-System",
          "vendor": "KusalkaSilva",
          "versions": [
            {
              "status": "affected",
              "version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "vuldb2026 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is the function getimagesize of the file upload_save.php. Executing a manipulation of the argument uploaded_file/image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "Unrestricted Upload",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Controls",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T19:00:11.131Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-416735 | KusalkaSilva Learning-Management-System upload_save.php getimagesize unrestricted upload",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/416735"
        },
        {
          "name": "VDB-416735 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/416735/cti"
        },
        {
          "name": "CVE-2026-108922 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-108922"
        },
        {
          "name": "Submit #994384 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 Unrestricted Upload",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/994384"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/6"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-11T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-11T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-11T19:35:28.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "KusalkaSilva Learning-Management-System upload_save.php getimagesize unrestricted upload",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-108922",
    "datePublished": "2026-10-12T19:00:11.131Z",
    "dateReserved": "2026-10-11T17:30:18.463Z",
    "dateUpdated": "2026-10-15T13:39:59.994Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108921 (GCVE-0-2026-108921)

Vulnerability from cvelistv5 – Published: 2026-10-12 18:45 – Updated: 2026-10-13 16:02

Title

KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication

Summary

A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_announcements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 16:02 UTC

CWE

CWE-306 - Missing Authentication
CWE-287 - Improper Authentication

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3860 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/416734	vdb-entrytechnical-description
https://vuldb.com/vuln/416734/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108921	third-party-advisory
https://vuldb.com/submit/994370	third-party-advisory
https://github.com/KusalkaSilva/Learning-Manageme…	exploitissue-tracking
https://github.com/KusalkaSilva/Learning-Manageme…	product

Impacted products

1 product

Vendor	Product	Version
KusalkaSilva	Learning-Management-System	Affected: ffeb873f8803f1e9664384ff75000c7da45466d2 cpe:2.3:a:kusalkasilva:learning-management-system::::::::

Credits

vuldb2026 (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108921",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T16:02:05.338476Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T16:02:16.429Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "State-Changing Endpoints"
          ],
          "product": "Learning-Management-System",
          "vendor": "KusalkaSilva",
          "versions": [
            {
              "status": "affected",
              "version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "vuldb2026 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_announcements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T18:45:15.546Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-416734 | KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/416734"
        },
        {
          "name": "VDB-416734 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/416734/cti"
        },
        {
          "name": "CVE-2026-108921 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-108921"
        },
        {
          "name": "Submit #994370 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 Missing Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/994370"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/5"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-11T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-11T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-11T19:35:24.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-108921",
    "datePublished": "2026-10-12T18:45:15.546Z",
    "dateReserved": "2026-10-11T17:30:13.900Z",
    "dateUpdated": "2026-10-13T16:02:16.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105921 (GCVE-0-2026-105921)

Vulnerability from cvelistv5 – Published: 2026-10-06 14:15 – Updated: 2026-10-06 14:50

Title

Kusalkasilva Learning-Management-System search_class.php sql injection

Summary

A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search_class.php. Such manipulation of the argument school_year leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 14:47 UTC

CWE

CWE-89 - SQL Injection
CWE-74 - Injection

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3860 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/413895	vdb-entrytechnical-description
https://vuldb.com/vuln/413895/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-105921	third-party-advisory
https://vuldb.com/submit/992659	third-party-advisory
https://github.com/KusalkaSilva/Learning-Manageme…	exploitissue-tracking
https://github.com/KusalkaSilva/Learning-Manageme…	product

Impacted products

1 product

Vendor	Product	Version
Kusalkasilva	Learning-Management-System	Affected: ffeb873f8803f1e9664384ff75000c7da45466d2 cpe:2.3:a:kusalkasilva:learning-management-system::::::::

Credits

Jameszhan783 (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105921",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T14:47:43.198439Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T14:50:14.844Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
          ],
          "product": "Learning-Management-System",
          "vendor": "Kusalkasilva",
          "versions": [
            {
              "status": "affected",
              "version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jameszhan783 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search_class.php. Such manipulation of the argument school_year leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T14:15:14.896Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413895 | Kusalkasilva Learning-Management-System search_class.php sql injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413895"
        },
        {
          "name": "VDB-413895 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413895/cti"
        },
        {
          "name": "CVE-2026-105921 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-105921"
        },
        {
          "name": "Submit #992659 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/992659"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/4"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-06T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-06T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-06T07:54:45.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Kusalkasilva Learning-Management-System search_class.php sql injection",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-105921",
    "datePublished": "2026-10-06T14:15:14.896Z",
    "dateReserved": "2026-10-06T05:49:28.053Z",
    "dateUpdated": "2026-10-06T14:50:14.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105920 (GCVE-0-2026-105920)

Vulnerability from cvelistv5 – Published: 2026-10-06 13:30 – Updated: 2026-10-09 00:59

Title

Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection

Summary

A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 00:58 UTC

CWE

CWE-89 - SQL Injection
CWE-74 - Injection

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3860 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/413894	vdb-entry
https://vuldb.com/vuln/413894/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-105920	third-party-advisory
https://vuldb.com/submit/992656	third-party-advisory
https://github.com/KusalkaSilva/Learning-Manageme…	exploitissue-tracking
https://github.com/KusalkaSilva/Learning-Manageme…	product

Impacted products

1 product

Vendor	Product	Version
Kusalkasilva	Learning-Management-System	Affected: ffeb873f8803f1e9664384ff75000c7da45466d2 cpe:2.3:a:kusalkasilva:learning-management-system::::::::

Credits

vuldb2026 (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105920",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T00:58:53.254521Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T00:59:05.177Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Student Registration Endpoint"
          ],
          "product": "Learning-Management-System",
          "vendor": "Kusalkasilva",
          "versions": [
            {
              "status": "affected",
              "version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "vuldb2026 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T13:30:11.719Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413894 | Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/413894"
        },
        {
          "name": "VDB-413894 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413894/cti"
        },
        {
          "name": "CVE-2026-105920 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-105920"
        },
        {
          "name": "Submit #992656 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/992656"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/3"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-06T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-06T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-06T07:54:41.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-105920",
    "datePublished": "2026-10-06T13:30:11.719Z",
    "dateReserved": "2026-10-06T05:49:24.622Z",
    "dateUpdated": "2026-10-09T00:59:05.177Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105919 (GCVE-0-2026-105919)

Vulnerability from cvelistv5 – Published: 2026-10-06 13:00 – Updated: 2026-10-06 17:12

Title

Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection

Summary

A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 17:11 UTC

CWE

CWE-89 - SQL Injection
CWE-74 - Injection

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3860 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/413893	vdb-entrytechnical-description
https://vuldb.com/vuln/413893/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-105919	third-party-advisory
https://vuldb.com/submit/992655	third-party-advisory
https://github.com/KusalkaSilva/Learning-Manageme…	exploitissue-tracking
https://github.com/KusalkaSilva/Learning-Manageme…	product

Impacted products

1 product

Vendor	Product	Version
Kusalkasilva	Learning-Management-System	Affected: ffeb873f8803f1e9664384ff75000c7da45466d2 cpe:2.3:a:kusalkasilva:learning-management-system::::::::

Credits

yinian328 (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105919",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T17:11:57.108209Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T17:12:29.497Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Administrator Login Endpoint"
          ],
          "product": "Learning-Management-System",
          "vendor": "Kusalkasilva",
          "versions": [
            {
              "status": "affected",
              "version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yinian328 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T13:00:15.810Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413893 | Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413893"
        },
        {
          "name": "VDB-413893 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413893/cti"
        },
        {
          "name": "CVE-2026-105919 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-105919"
        },
        {
          "name": "Submit #992655 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/992655"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/2"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-06T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-06T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-06T07:54:38.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-105919",
    "datePublished": "2026-10-06T13:00:15.810Z",
    "dateReserved": "2026-10-06T05:49:21.184Z",
    "dateUpdated": "2026-10-06T17:12:29.497Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105918 (GCVE-0-2026-105918)

Vulnerability from cvelistv5 – Published: 2026-10-06 11:45 – Updated: 2026-10-06 17:40

Title

Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection

Summary

A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 17:06 UTC

CWE

CWE-89 - SQL Injection
CWE-74 - Injection

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3860 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/413892	vdb-entrytechnical-description
https://vuldb.com/vuln/413892/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-105918	third-party-advisory
https://vuldb.com/submit/992654	third-party-advisory
https://github.com/KusalkaSilva/Learning-Manageme…	exploitissue-tracking
https://github.com/KusalkaSilva/Learning-Manageme…	product

Impacted products

1 product

Vendor	Product	Version
Kusalkasilva	Learning-Management-System	Affected: ffeb873f8803f1e9664384ff75000c7da45466d2 cpe:2.3:a:kusalkasilva:learning-management-system::::::::

Credits

yinian328 (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105918",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T17:06:36.935710Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T17:40:12.577Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Login Endpoint"
          ],
          "product": "Learning-Management-System",
          "vendor": "Kusalkasilva",
          "versions": [
            {
              "status": "affected",
              "version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yinian328 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T11:45:14.525Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413892 | Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413892"
        },
        {
          "name": "VDB-413892 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413892/cti"
        },
        {
          "name": "CVE-2026-105918 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-105918"
        },
        {
          "name": "Submit #992654 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/992654"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/1"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/KusalkaSilva/Learning-Management-System/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-06T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-06T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-06T07:54:34.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-105918",
    "datePublished": "2026-10-06T11:45:14.525Z",
    "dateReserved": "2026-10-06T05:49:17.217Z",
    "dateUpdated": "2026-10-06T17:40:12.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

12 vulnerabilities by KusalkaSilva

CVE-2026-108922 (GCVE-0-2026-108922)

CVE-2026-108921 (GCVE-0-2026-108921)

CVE-2026-105921 (GCVE-0-2026-105921)

CVE-2026-105920 (GCVE-0-2026-105920)

CVE-2026-105919 (GCVE-0-2026-105919)

CVE-2026-105918 (GCVE-0-2026-105918)

CVE-2026-108922 (GCVE-0-2026-108922)

CVE-2026-108921 (GCVE-0-2026-108921)

CVE-2026-105921 (GCVE-0-2026-105921)

CVE-2026-105920 (GCVE-0-2026-105920)

CVE-2026-105919 (GCVE-0-2026-105919)

CVE-2026-105918 (GCVE-0-2026-105918)