The vulnerability arises in the remove_announcements.php file of the Learning‑Management‑System, where the mysql_query function executes deletion queries based on an ID parameter without checking user authentication. An attacker who can supply a crafted ID value can remotely trigger the endpoint and delete announcements. The flaw is a classic authentication bypass (CWE‑287, CWE‑306) that directly compromises data integrity and could be used to erase course material or other sensitive information.

All releases of the KusalkaSilva Learning‑Management‑System that have not yet been updated beyond commit ffeb873f8803f1e9664384ff75000c7da45466d2 are affected. The product follows a rolling release model, so the vulnerability may exist in any active branch until a patch is issued.

The CVSS score of 6.9 indicates medium to high risk. Although the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, the attack can be carried out remotely without authentication. Exploitability is straightforward: an attacker simply crafts a request with a valid ID to invoke the removal operation. Given the lack of authentication and the public nature of the exploit, organizations using the system should treat this as a high‑severity concern and implement mitigations promptly.