CVE-2026-105918: Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection
A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysqlerror of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote, unauthenticated attacker can target the login endpoint by manipulating the username or password arguments. No user interaction or prior privileges are required.
Are fixed or affected release versions available?
No. The project uses continuous delivery with rolling releases, and no affected or updated version details are available.
How likely is exploitation?
Public exploit details have been disclosed and may be used. The issue has low attack complexity and can be initiated remotely.
Has the project provided a fix or response?
The project was notified early through an issue report but has not responded. The available information does not identify a vendor-provided fix.