Threat database

CVE-2026-108922 is a medium-severity vulnerability in the KusalkaSilva Learning-Management-System affecting the getimagesize function in upload_save.php. It allows remote attackers to perform unrestricted file uploads by manipulating the uploaded_file/image argument. The product uses a rolling release model, so no specific affected or fixed versions are identified. The issue was reported early but remains unaddressed, and exploit code has been published.

CVE-2026-108921 is a medium severity vulnerability in the KusalkaSilva Learning-Management-System affecting the remove_announcements.php component. It involves missing authentication in the mysql_query function when manipulating the ID argument, allowing remote attackers to perform unauthorized actions. The product uses a rolling release model, so specific affected versions are not provided. The vulnerability is publicly known, but no vendor response or patch is available yet.

A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search_class.php. Such manipulation of the argument school_year leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-105920 is a SQL injection vulnerability in the Kusalkasilva Learning-Management-System affecting the student_signup.php file in the Student Registration Endpoint. The vulnerability allows remote attackers to manipulate SQL queries, potentially compromising the database. The product uses a rolling release model, so specific affected versions are not identified. The issue was reported early but has not yet been addressed by the vendor. The vulnerability has a medium severity with a CVSS score of 6.9 and public exploit details are available.

A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.