CVE-2026-108921

A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_announcements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0

5.5CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS

0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-25)

CWEs

CWE-287, CWE-306

Published

2026-10-12

Modified

2026-10-13

Record from

the NVD, synced 2026-10-19

References

• https://github.com/KusalkaSilva/Learning-Management-System/
• https://github.com/KusalkaSilva/Learning-Management-System/issues/5
• https://vuldb.com/cve/CVE-2026-108921
• https://vuldb.com/submit/994370
• https://vuldb.com/vuln/416734

Check your stackJSON