ILIAS LMS CVE-2026-12789

Q: What is the CVSS score of CVE-2026-12789?

CVE-2026-12789 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38153 LOW

SQL Injection (CWE-89)

2026-06-21 VulDB

GHSA-69g6-pggc-389p

PHP SQLi Ilias Learning Management System

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

High-privilege authentication required to reach the tracking component; no scope change as impact stays within the LMS database layer.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:31 vuln.today

Severity Changed

Jun 21, 2026 - 09:22 NVD

MEDIUM LOW

CVSS changed

Jun 21, 2026 - 09:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

DescriptionCVE.org

A vulnerability was identified in ILIAS Learning Management System 11.0. This issue affects the function ilTrQuery::executeQueries of the file components/ILIAS/Tracking/classes/class.ilTrQuery.php of the component Learning Progress Tracking. Such manipulation of the argument troup_table_nav leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in ILIAS Learning Management System 11.0 allows a remote, high-privileged attacker to manipulate database queries via the Learning Progress Tracking component. The troup_table_nav argument passed to ilTrQuery::executeQueries in components/ILIAS/Tracking/classes/class.ilTrQuery.php is incorporated into SQL statements without adequate sanitization, enabling low-impact reads and writes against the underlying database. Publicly available exploit code exists (CVSS 4.0 E:P), and the vendor did not respond to pre-disclosure contact, meaning no official patch has been issued.

Technical ContextAI

ILIAS is an open-source PHP-based Learning Management System. The vulnerable code path resides in the Learning Progress Tracking subsystem, specifically the ilTrQuery::executeQueries() method within class.ilTrQuery.php. The troup_table_nav parameter - likely a table-navigation sorting or grouping control - is user-controllable and is interpolated or concatenated directly into a SQL query without parameterization or sufficient escaping, satisfying CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The CPE string cpe:2.3:a:ilias:learning_management_system:*:*:*:*:*:*:*:* confirms scope to the ILIAS LMS application layer, not the underlying OS or web server. Because the parameter is a navigation token typically submitted via authenticated HTTP requests, the injection surface is reachable remotely but gated behind high-privilege authentication.

RemediationAI

No vendor-released patch has been identified at time of analysis - the ILIAS maintainers did not respond to the researcher's pre-disclosure contact. Organizations running ILIAS LMS 11.0 should apply the following compensating controls in the absence of a patch: restrict administrative and course-manager role assignments to the minimum necessary set of trusted users, as exploitation requires high-privilege credentials; deploy a Web Application Firewall (WAF) rule set targeting SQL injection patterns on parameters associated with table-navigation controls (e.g., parameters matching *table_nav*), noting that WAF rules may block legitimate sorting/filtering functionality if not tuned carefully; consider disabling or restricting access to the Learning Progress Tracking component if it is not operationally required, accepting the trade-off of lost tracking reporting capability; and audit database user permissions so that the ILIAS database account operates under least-privilege - ideally read-only or scoped to specific tables - to contain the impact of a successful injection. Monitor VulDB (https://vuldb.com/vuln/372531) and the official ILIAS GitHub repository for patch releases.