CVE-2026-105918: SQL Injection in Kusalkasilva Learning-Management-System

This vulnerability in Kusalkasilva Learning-Management-System up to commit ffeb873f8803f1e9664384ff75000c7da45466d2 allows remote attackers to perform SQL injection via manipulation of the username or password arguments in the login.php file's mysql_error function within the Login Endpoint. The product employs continuous delivery with rolling releases, and no explicit versioning information is provided for affected or patched releases. The vendor has been notified but has not responded or issued a fix. The CVSS 4.0 base score is 6.9, indicating a medium severity risk with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database by injecting malicious input into the username or password fields during login. This could lead to unauthorized data access or modification. However, the impact is rated medium due to limited scope and no confirmed active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a fix is available, consider implementing input validation and web application firewall rules to mitigate SQL injection attempts on the login endpoint.