Threats Tagged 'cve-2026-105919'

A SQL injection vulnerability exists in the Kusalkasilva Learning-Management-System in the admin/login.php file's mysql_query function. This vulnerability allows remote attackers to manipulate the username and password parameters to execute arbitrary SQL commands. The vulnerability has a CVSS score of 7.3 (medium severity). The project does not use versioning, so affected versions cannot be precisely identified. The issue was reported to the project early, but no response or fix has been provided yet. Exploit code has been publicly disclosed, but no known exploitation in the wild has been confirmed.

A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.