CVE-2026-108921: KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication
A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysqlquery of the file removeannouncements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker can exploit it without authentication or user interaction by manipulating the ID argument handled by remove_announcements.php. Public exploit code is available, which increases the likelihood of attempted exploitation.
Which deployments should be considered affected?
Deployments using KusalkaSilva Learning-Management-System at or before commit ffeb873f8803f1e9664384ff75000c7da45466d2 should be considered affected. Because the project uses a rolling release model, no fixed affected or remediated version numbers are available.
What is the likely impact of successful exploitation?
The vulnerability affects a state-changing endpoint and can allow unauthenticated manipulation associated with the ID parameter in remove_announcements.php. The supplied severity vector indicates potential low impact to confidentiality, integrity, and availability.
Is a vendor fix available?
The available information does not identify a fix. The project was notified through an issue report but had not responded at the time of publication.