CVE-2026-108921CWE-287CWE-306

CVE-2026-108921

High · published October 12, 2026

CVSS v3.1
7.3
EPSS
1%
Percentile
50.8
In the wild
Unconfirmed
What it is

A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_announcements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00657 · 50.8th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2026-10-12T23:16Z
References (6)
https://github.com/KusalkaSilva/Learning-Management-System/ · [email protected]https://github.com/KusalkaSilva/Learning-Management-System/issues/5 · [email protected]https://vuldb.com/cve/CVE-2026-108921 · [email protected]https://vuldb.com/submit/994370 · [email protected]https://vuldb.com/vuln/416734 · [email protected]https://vuldb.com/vuln/416734/cti · [email protected]
EPSS history
Timeline
  • 14 OCT 03:27Z
    EPSS moved — → 1%
    epss
  • 12 OCT 18:45Z
    KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication
    cvelistv5
  • 12 OCT 18:45Z
    KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication
    cvelistv5