CVE-2026-108921 Details
Description
A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_announcements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability allowing unauthenticated users to perform destructive actions has been identified in KusalkaSilva Learning Management System versions prior to commit ffeb873f8803f1e9664384ff75000c7da45466d2. The issue arises in the remove_announcements.php file within the State-Changing Endpoints component. The vulnerability allows for SQL injection by manipulating the ID parameter, leading to unauthorized deletion of announcements, class enrollments, files, classes, students, teachers, and other administrative data. Additionally, this vulnerability can be exploited to deactivate all teacher accounts, causing a denial-of-service effect on the teaching side.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/KusalkaSilva/Learning-Management-System/ | [email protected] | ProductSource CodeVendor |
| https://github.com/KusalkaSilva/Learning-Management-System/issues/5 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://vuldb.com/cve/CVE-2026-108921 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/994370 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416734 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416734/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| KusalkaSilva Learning-Management-System | <ffeb873f8803f1e9664384ff75000c7da45466d2> |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |