SQL Injection Vulnerability in Kusalkasilva Learning-Management-System by KusalkaSilva
CVE-2026-105921

5.3MEDIUM

Key Information:

Vendor: Kusalkasilva
Status: Learning-management-system
Vendor: CVE Published:; 6 October 2026

🔔 Create Kusalkasilva Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-105921?

A vulnerability exists in the Kusalkasilva Learning-Management-System that allows an attacker to manipulate the argument 'school_year' via the file search_class.php. This SQL injection vulnerability can be exploited remotely, potentially leading to unauthorized access or modification of the system's database. The exploit is publicly available, and despite the project being made aware of the issue through an early report, no fixes or updates have been released as of yet. As the system operates on a rolling release basis, users should take immediate precautions to secure their installations.

Affected Version(s)

Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-105921 - Proof of Concept