CVE-2026-12789: ILIAS Learning Management System Learning Progress Tracking class.ilTrQuery.php executeQueries sql injection
A vulnerability was identified in ILIAS Learning Management System 11.0. This issue affects the function ilTrQuery::executeQueries of the file components/ILIAS/Tracking/classes/class.ilTrQuery.php of the component Learning Progress Tracking. Such manipulation of the argument trouptablenav leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. This issue was independently identified and fixed internally by the vendor's own security team ahead of this report.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12789?
CVE-2026-12789 has a medium severity rating of 4.7.
What is CVE-2026-12789?
CVE-2026-12789 is a SQL injection vulnerability identified in ILIAS Learning Management System 11.0 targeting the Learning Progress Tracking component.
How do I fix CVE-2026-12789?
To fix CVE-2026-12789, it is recommended to update ILIAS Learning Management System to the latest version that addresses this vulnerability.
What does CVE-2026-12789 affect?
CVE-2026-12789 affects the function ilTrQuery::executeQueries in the file class.ilTrQuery.php within the Learning Progress Tracking component.
What is the potential impact of CVE-2026-12789?
The potential impact of CVE-2026-12789 includes unauthorized manipulation of database queries leading to information disclosure or data modification.