Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

Kusalkasilva Learning Management System can be tricked into database attacks

CVE-2026-105921 · published 12 days ago
Summary

The search_class.php component of the Kusalkasilva Learning Management System accepts a school_year input that can be manipulated to run unauthorized database commands. An attacker can exploit this from anywhere on the internet and may view, change, or delete school data. Update to the latest code that sanitizes inputs, or apply a patch that validates the school_year parameter, and limit public access to the search function.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
kusalkasilva learning-management-system ffeb873f8803f1e9664384ff75000c7da45466d2
Original advisory text
Kusalkasilva Learning-Management-System search_class.php sql injection
A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search_class.php. Such manipulation of the argument school_year leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
CWE-74Injection
Timeline
Published6 Oct 2026
Updated14 Oct 2026
First seen6 Oct 2026
Sources
CVE-2026-105921 · NVD
CVE-2026-105921 · MITRE
CVE-2026-105921 · OSV
Track software like this
Free during beta