CVE-2026-105920: SQL Injection in Kusalkasilva Learning-Management-System

A SQL injection vulnerability exists in Kusalkasilva Learning-Management-System up to commit ffeb873f8803f1e9664384ff75000c7da45466d2, specifically in an unknown function of student_signup.php within the Student Registration Endpoint. This flaw allows remote attackers to inject malicious SQL commands, potentially leading to unauthorized database access or manipulation. The product follows a rolling release model, so exact affected versions are not specified. The vulnerability was responsibly disclosed early to the project, which has not yet responded or issued a patch. The CVSS 4.0 score is 6.9 (medium severity), and public exploit information is available, though no active exploitation is confirmed.

Successful exploitation of this vulnerability could allow remote attackers to perform SQL injection attacks against the Learning-Management-System database via the student_signup.php endpoint. This may lead to unauthorized data access or modification. However, there is no evidence of active exploitation in the wild at this time.

No official fix or patch has been released yet, and the vendor has not responded to the issue report. Patch status is not yet confirmed — check the vendor advisory or project repository for current remediation guidance. Until a fix is available, consider applying input validation or web application firewall rules to mitigate SQL injection risks on the affected endpoint.