KusalkaSilva CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM KusalkaSilva CVE published 2026-10-12

CVE-2026-108922

A vulnerability was found in KusalkaSilva Learning-Management-System, specifically in the upload_save.php file, which allows for unrestricted file uploads due to improper validation of the getimagesize function. This issue, tracked as CVE-2026-108922, was publicly disclosed on October 12, 2026. The vulnerability has a CVSS score of 5.3 and is considered medium severity. The affected product operates on a [truncated]

MEDIUM KusalkaSilva CVE published 2026-10-12

CVE-2026-108921

A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_announcements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used.