CVE-2026-105921: SQL Injection in Kusalkasilva Learning-Management-System

Kusalkasilva Learning-Management-System up to commit ffeb873f8803f1e9664384ff75000c7da45466d2 contains a SQL injection vulnerability in an unknown function within search_class.php. The vulnerability arises from improper handling of the school_year argument, enabling remote attackers to inject SQL commands. The product's rolling release model means no discrete version numbers are available for affected or fixed states. The vulnerability was disclosed via an issue report, but no response or patch has been provided by the project. Exploit code is publicly available, though no known exploitation in the wild has been reported.

Successful exploitation could lead to unauthorized SQL command execution, potentially resulting in data disclosure, data modification, or denial of service. The CVSS vector indicates low attack complexity, no user interaction required, and partial impact on confidentiality, integrity, and availability. However, the overall severity is medium due to limited impact scope and the requirement for some privileges (PR:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should consider applying manual mitigations such as input validation or restricting access to the vulnerable functionality until an official fix is released.