# CVE-2026-105919: Kusalkasilva Learning-Management-System SQL injection in administrator login

Source: https://junglewise.ai/threats/cve-2026-105919-a-vulnerability-was-found-in-kusalkasilva-learning-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-105919 · Severity: high · CVSS 7.3 · Published 2026-10-06

Kusalkasilva Learning-Management-System is a PHP-based learning management platform that provides student, lecturer, and administrator panels. An unauthenticated attacker can bypass administrator authentication via SQL injection in the login endpoint, gaining complete control over the system to manage users, classes, and content without knowing any credentials.

Technologies: [Kusalkasilva Learning-Management-System](https://junglewise.ai/threats/technologies/kusalkasilva-learning-management-system). Vendors: [Kusalkasilva](https://junglewise.ai/threats/vendors/kusalkasilva).

## Quick answers

**Is CVE-2026-105919 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105919 being exploited in the wild.

**How severe is CVE-2026-105919?** High severity, with a CVSS score of 7.3, published 6 October 2026.

**Which products and versions are affected?** Kusalkasilva Learning-Management-System up to commit ffeb873f8803f1e9664384ff75000c7da45466d2.

**Is there a fix for CVE-2026-105919?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-105919 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105919?** Check whether you run Kusalkasilva Learning-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The administrator login endpoint in admin/login.php constructs SQL queries by string concatenation of unsanitized POST parameters (username and password) directly into a WHERE clause, allowing SQL injection through the single-quote character. An attacker can inject a boolean payload like `' OR 1=1 LIMIT 1 -- -` to authenticate as an arbitrary user and establish an authenticated administrator session remotely with no preconditions. The legacy mysql_query() API lacks parameterized query support, making this a critical authentication bypass yielding full database read/write access.

## Affected products

- Kusalkasilva Learning-Management-System up to commit ffeb873f8803f1e9664384ff75000c7da45466d2

## Timeline

- 2026-09-20: disclosed
- 2026-10-06: advisory

## References

- [https://github.com/KusalkaSilva/Learning-Management-System/](https://github.com/KusalkaSilva/Learning-Management-System/)
- [https://github.com/KusalkaSilva/Learning-Management-System/issues/2](https://github.com/KusalkaSilva/Learning-Management-System/issues/2)

## Related threats

- [KusalkaSilva Learning-Management-System unrestricted file upload in upload_save.php](https://junglewise.ai/threats/cve-2026-108922-a-flaw-has-been-found-in-kusalkasilva-learning-management-system)
- [KusalkaSilva Learning-Management-System authentication bypass in remove_announcements.php](https://junglewise.ai/threats/cve-2026-108921-a-vulnerability-was-detected-in-kusalkasilva-learning-management)
- [Kusalkasilva Learning-Management-System SQL injection in search_class.php](https://junglewise.ai/threats/cve-2026-105921-a-vulnerability-was-identified-in-kusalkasilva-learning)
- [Kusalkasilva Learning-Management-System SQL injection in student registration](https://junglewise.ai/threats/cve-2026-105920-a-vulnerability-was-determined-in-kusalkasilva-learning)
- [Kusalkasilva Learning-Management-System SQL injection in login endpoint](https://junglewise.ai/threats/cve-2026-105918-a-vulnerability-has-been-found-in-kusalkasilva-learning)