Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
8 vulnerabilities found for Learning-Management-System by Kusalkasilva
CVE-2026-105921 (GCVE-0-2026-105921)
Vulnerability from nvd – Published: 2026-10-06 14:15 – Updated: 2026-10-06 14:50
VLAI
EPSS
VEX
Title
Kusalkasilva Learning-Management-System search_class.php sql injection
Summary
A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search_class.php. Such manipulation of the argument school_year leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 14:47 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/413895 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/413895/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-105921 | third-party-advisory |
| https://vuldb.com/submit/992659 | third-party-advisory |
| https://github.com/KusalkaSilva/Learning-Manageme… | exploitissue-tracking |
| https://github.com/KusalkaSilva/Learning-Manageme… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Kusalkasilva | Learning-Management-System |
Affected:
ffeb873f8803f1e9664384ff75000c7da45466d2
cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105921",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T14:47:43.198439Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:50:14.844Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
],
"product": "Learning-Management-System",
"vendor": "Kusalkasilva",
"versions": [
{
"status": "affected",
"version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jameszhan783 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search_class.php. Such manipulation of the argument school_year leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:15:14.896Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-413895 | Kusalkasilva Learning-Management-System search_class.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/413895"
},
{
"name": "VDB-413895 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/413895/cti"
},
{
"name": "CVE-2026-105921 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-105921"
},
{
"name": "Submit #992659 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/992659"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/4"
},
{
"tags": [
"product"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-06T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-06T07:54:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "Kusalkasilva Learning-Management-System search_class.php sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-105921",
"datePublished": "2026-10-06T14:15:14.896Z",
"dateReserved": "2026-10-06T05:49:28.053Z",
"dateUpdated": "2026-10-06T14:50:14.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105920 (GCVE-0-2026-105920)
Vulnerability from nvd – Published: 2026-10-06 13:30 – Updated: 2026-10-09 00:59
VLAI
EPSS
VEX
Title
Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection
Summary
A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 00:58 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/413894 | vdb-entry |
| https://vuldb.com/vuln/413894/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-105920 | third-party-advisory |
| https://vuldb.com/submit/992656 | third-party-advisory |
| https://github.com/KusalkaSilva/Learning-Manageme… | exploitissue-tracking |
| https://github.com/KusalkaSilva/Learning-Manageme… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Kusalkasilva | Learning-Management-System |
Affected:
ffeb873f8803f1e9664384ff75000c7da45466d2
cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105920",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T00:58:53.254521Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T00:59:05.177Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"Student Registration Endpoint"
],
"product": "Learning-Management-System",
"vendor": "Kusalkasilva",
"versions": [
{
"status": "affected",
"version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "vuldb2026 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:30:11.719Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-413894 | Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/413894"
},
{
"name": "VDB-413894 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/413894/cti"
},
{
"name": "CVE-2026-105920 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-105920"
},
{
"name": "Submit #992656 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/992656"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/3"
},
{
"tags": [
"product"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-06T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-06T07:54:41.000Z",
"value": "VulDB entry last update"
}
],
"title": "Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-105920",
"datePublished": "2026-10-06T13:30:11.719Z",
"dateReserved": "2026-10-06T05:49:24.622Z",
"dateUpdated": "2026-10-09T00:59:05.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105919 (GCVE-0-2026-105919)
Vulnerability from nvd – Published: 2026-10-06 13:00 – Updated: 2026-10-06 17:12
VLAI
EPSS
VEX
Title
Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection
Summary
A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 17:11 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/413893 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/413893/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-105919 | third-party-advisory |
| https://vuldb.com/submit/992655 | third-party-advisory |
| https://github.com/KusalkaSilva/Learning-Manageme… | exploitissue-tracking |
| https://github.com/KusalkaSilva/Learning-Manageme… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Kusalkasilva | Learning-Management-System |
Affected:
ffeb873f8803f1e9664384ff75000c7da45466d2
cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105919",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T17:11:57.108209Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:12:29.497Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"Administrator Login Endpoint"
],
"product": "Learning-Management-System",
"vendor": "Kusalkasilva",
"versions": [
{
"status": "affected",
"version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yinian328 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:00:15.810Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-413893 | Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/413893"
},
{
"name": "VDB-413893 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/413893/cti"
},
{
"name": "CVE-2026-105919 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-105919"
},
{
"name": "Submit #992655 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/992655"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/2"
},
{
"tags": [
"product"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-06T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-06T07:54:38.000Z",
"value": "VulDB entry last update"
}
],
"title": "Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-105919",
"datePublished": "2026-10-06T13:00:15.810Z",
"dateReserved": "2026-10-06T05:49:21.184Z",
"dateUpdated": "2026-10-06T17:12:29.497Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105918 (GCVE-0-2026-105918)
Vulnerability from nvd – Published: 2026-10-06 11:45 – Updated: 2026-10-06 17:40
VLAI
EPSS
VEX
Title
Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection
Summary
A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 17:06 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/413892 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/413892/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-105918 | third-party-advisory |
| https://vuldb.com/submit/992654 | third-party-advisory |
| https://github.com/KusalkaSilva/Learning-Manageme… | exploitissue-tracking |
| https://github.com/KusalkaSilva/Learning-Manageme… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Kusalkasilva | Learning-Management-System |
Affected:
ffeb873f8803f1e9664384ff75000c7da45466d2
cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105918",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T17:06:36.935710Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:40:12.577Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"Login Endpoint"
],
"product": "Learning-Management-System",
"vendor": "Kusalkasilva",
"versions": [
{
"status": "affected",
"version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yinian328 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T11:45:14.525Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-413892 | Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/413892"
},
{
"name": "VDB-413892 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/413892/cti"
},
{
"name": "CVE-2026-105918 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-105918"
},
{
"name": "Submit #992654 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/992654"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/1"
},
{
"tags": [
"product"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-06T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-06T07:54:34.000Z",
"value": "VulDB entry last update"
}
],
"title": "Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-105918",
"datePublished": "2026-10-06T11:45:14.525Z",
"dateReserved": "2026-10-06T05:49:17.217Z",
"dateUpdated": "2026-10-06T17:40:12.577Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105921 (GCVE-0-2026-105921)
Vulnerability from cvelistv5 – Published: 2026-10-06 14:15 – Updated: 2026-10-06 14:50
VLAI
EPSS
VEX
Title
Kusalkasilva Learning-Management-System search_class.php sql injection
Summary
A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search_class.php. Such manipulation of the argument school_year leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 14:47 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/413895 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/413895/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-105921 | third-party-advisory |
| https://vuldb.com/submit/992659 | third-party-advisory |
| https://github.com/KusalkaSilva/Learning-Manageme… | exploitissue-tracking |
| https://github.com/KusalkaSilva/Learning-Manageme… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Kusalkasilva | Learning-Management-System |
Affected:
ffeb873f8803f1e9664384ff75000c7da45466d2
cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105921",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T14:47:43.198439Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:50:14.844Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
],
"product": "Learning-Management-System",
"vendor": "Kusalkasilva",
"versions": [
{
"status": "affected",
"version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jameszhan783 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search_class.php. Such manipulation of the argument school_year leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:15:14.896Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-413895 | Kusalkasilva Learning-Management-System search_class.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/413895"
},
{
"name": "VDB-413895 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/413895/cti"
},
{
"name": "CVE-2026-105921 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-105921"
},
{
"name": "Submit #992659 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/992659"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/4"
},
{
"tags": [
"product"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-06T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-06T07:54:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "Kusalkasilva Learning-Management-System search_class.php sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-105921",
"datePublished": "2026-10-06T14:15:14.896Z",
"dateReserved": "2026-10-06T05:49:28.053Z",
"dateUpdated": "2026-10-06T14:50:14.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105920 (GCVE-0-2026-105920)
Vulnerability from cvelistv5 – Published: 2026-10-06 13:30 – Updated: 2026-10-09 00:59
VLAI
EPSS
VEX
Title
Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection
Summary
A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 00:58 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/413894 | vdb-entry |
| https://vuldb.com/vuln/413894/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-105920 | third-party-advisory |
| https://vuldb.com/submit/992656 | third-party-advisory |
| https://github.com/KusalkaSilva/Learning-Manageme… | exploitissue-tracking |
| https://github.com/KusalkaSilva/Learning-Manageme… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Kusalkasilva | Learning-Management-System |
Affected:
ffeb873f8803f1e9664384ff75000c7da45466d2
cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105920",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T00:58:53.254521Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T00:59:05.177Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"Student Registration Endpoint"
],
"product": "Learning-Management-System",
"vendor": "Kusalkasilva",
"versions": [
{
"status": "affected",
"version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "vuldb2026 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:30:11.719Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-413894 | Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/413894"
},
{
"name": "VDB-413894 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/413894/cti"
},
{
"name": "CVE-2026-105920 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-105920"
},
{
"name": "Submit #992656 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/992656"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/3"
},
{
"tags": [
"product"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-06T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-06T07:54:41.000Z",
"value": "VulDB entry last update"
}
],
"title": "Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-105920",
"datePublished": "2026-10-06T13:30:11.719Z",
"dateReserved": "2026-10-06T05:49:24.622Z",
"dateUpdated": "2026-10-09T00:59:05.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105919 (GCVE-0-2026-105919)
Vulnerability from cvelistv5 – Published: 2026-10-06 13:00 – Updated: 2026-10-06 17:12
VLAI
EPSS
VEX
Title
Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection
Summary
A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 17:11 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/413893 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/413893/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-105919 | third-party-advisory |
| https://vuldb.com/submit/992655 | third-party-advisory |
| https://github.com/KusalkaSilva/Learning-Manageme… | exploitissue-tracking |
| https://github.com/KusalkaSilva/Learning-Manageme… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Kusalkasilva | Learning-Management-System |
Affected:
ffeb873f8803f1e9664384ff75000c7da45466d2
cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105919",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T17:11:57.108209Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:12:29.497Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"Administrator Login Endpoint"
],
"product": "Learning-Management-System",
"vendor": "Kusalkasilva",
"versions": [
{
"status": "affected",
"version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yinian328 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:00:15.810Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-413893 | Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/413893"
},
{
"name": "VDB-413893 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/413893/cti"
},
{
"name": "CVE-2026-105919 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-105919"
},
{
"name": "Submit #992655 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/992655"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/2"
},
{
"tags": [
"product"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-06T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-06T07:54:38.000Z",
"value": "VulDB entry last update"
}
],
"title": "Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-105919",
"datePublished": "2026-10-06T13:00:15.810Z",
"dateReserved": "2026-10-06T05:49:21.184Z",
"dateUpdated": "2026-10-06T17:12:29.497Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105918 (GCVE-0-2026-105918)
Vulnerability from cvelistv5 – Published: 2026-10-06 11:45 – Updated: 2026-10-06 17:40
VLAI
EPSS
VEX
Title
Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection
Summary
A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 17:06 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/413892 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/413892/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-105918 | third-party-advisory |
| https://vuldb.com/submit/992654 | third-party-advisory |
| https://github.com/KusalkaSilva/Learning-Manageme… | exploitissue-tracking |
| https://github.com/KusalkaSilva/Learning-Manageme… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Kusalkasilva | Learning-Management-System |
Affected:
ffeb873f8803f1e9664384ff75000c7da45466d2
cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105918",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T17:06:36.935710Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:40:12.577Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"Login Endpoint"
],
"product": "Learning-Management-System",
"vendor": "Kusalkasilva",
"versions": [
{
"status": "affected",
"version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yinian328 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T11:45:14.525Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-413892 | Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/413892"
},
{
"name": "VDB-413892 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/413892/cti"
},
{
"name": "CVE-2026-105918 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-105918"
},
{
"name": "Submit #992654 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/992654"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/1"
},
{
"tags": [
"product"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-06T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-06T07:54:34.000Z",
"value": "VulDB entry last update"
}
],
"title": "Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-105918",
"datePublished": "2026-10-06T11:45:14.525Z",
"dateReserved": "2026-10-06T05:49:17.217Z",
"dateUpdated": "2026-10-06T17:40:12.577Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}