A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. (CVE-2026-105920)

The Kusalkasilva Learning-Management-System contains a SQL injection vulnerability in an unknown function within the student_signup.php file, specifically in the Student Registration Endpoint component. This vulnerability can be exploited remotely without authentication, allowing attackers to manipulate SQL queries. The vulnerability has been publicly disclosed, but the project has not yet responded or provided a fix. Due to the rolling release model, exact affected versions are not specified. The CVSS 3.1 base score is 7.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

Successful exploitation could allow an unauthenticated remote attacker to perform SQL injection attacks, potentially leading to unauthorized data disclosure, data manipulation, and disruption of service. The impact affects confidentiality, integrity, and availability at a low to medium level as indicated by the CVSS score.

No official fix or patch is currently available, and the project has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a fix is released, consider applying application-layer protections such as web application firewalls (WAF) to detect and block SQL injection attempts targeting the student_signup.php endpoint.