Fox Lms CVE-2026-31922

Valid user account credentials required for Fox LMS version <= 1.0.6.3. Vulnerable parameter accepts unsanitized user input in SQL queries without proper parameterization.

Despite the high CVSS score of 8.5, the real-world risk appears moderate based on available signals. The CVSS vector indicates network-accessible attack requiring low privileges but with changed scope impacting confidentiality and availability. The low complexity suggests easy exploitation once authenticated. However, the lack of KEV listing indicates no known active exploitation, and no public proof-of-concept has been identified. Without EPSS data or SSVC signals, this appears to be a serious but not critical vulnerability that should be prioritized for patching but likely isn't being actively targeted by threat actors currently.

An attacker with legitimate low-privileged access to the Fox LMS platform could inject malicious SQL payloads into vulnerable input fields or API parameters. Through blind SQL injection techniques using boolean conditions or time delays, the attacker could systematically extract sensitive data from the database including user credentials, course information, or administrative data. The network-based attack vector and low complexity make this exploitable by moderately skilled attackers with basic authenticated access to the system.