HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-105919 — A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb8...

·Source: NIST NVD

Updated:

Executive Summary

A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be

Analysis

A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet. CVSS Score: 7.3. Published: 2026-10-06T13:16:47.120.

Indicators of Compromise (2)

SHA-1 (1)
ffeb873f8803f1e9664384ff75000c7da45466d2
VirusTotalAnyRunJoe Sandbox
CVE (1)
CVE-2026-105919
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 6, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Pepkor's $1.3bn fintech deal comes under shareholder scrutiny

South African retailer Pepkor is facing complaints from directors and investors over a deal to merge its fintech arm with a rival company.

Finextra
MEDIUMVulnerability

Net Closes Around ShinyHunters with Another FBI Arrest

The FBI has arrested a Canadian cybersecurity executive as it continues its crackdown on ShinyHunters

Infosecurity Magazine
CRITICALVulnerability

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The

CVE-2026-85097
The Hacker News