Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16

Export CSV
CVE-2026-63229

Pre-authentication blind SQL injection vulnerability

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Three Learning
Products
Koollab Lms
CVE-2026-63227

Unrestricted SCORM file upload vulnerability

An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Three Learning
Products
Koollab Lms
CVE-2026-63228

Unrestricted image upload vulnerability

An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feedback mail registration endpoint, potentially enabling further attacks on the server.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed
Vendors
Three Learning
Products
Koollab Lms
CVE-2026-63230

Pre-authentication error-based SQL injection vulnerability

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Three Learning
Products
Koollab Lms
CVE-2026-63231

Post-authentication SQL injection vulnerability

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Three Learning
Products
Koollab Lms
CVE-2026-63232

SQL injection and unsafe deserialisation vulnerability

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Three Learning
Products
Koollab Lms
CVE-2026-63233

SQL injection and unsafe deserialisation vulnerability

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Three Learning
Products
Koollab Lms
CVE-2026-63234

SQL injection and unsafe deserialisation vulnerability

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Three Learning
Products
Koollab Lms
CVE-2026-63235

Improper access control vulnerability

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email address via the login kickout endpoint, resulting in a denial of service.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Three Learning
Products
Koollab Lms
CVE-2026-63236

Improper access control vulnerability

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Three Learning
Products
Koollab Lms
CVE-2026-63237

TOTP two-factor authentication bypass vulnerability

A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and bypass the second authentication factor, potentially enabling unauthorised access to administrator accounts.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Three Learning
Products
Koollab Lms
CVE-2026-63238

Authentication bypass vulnerability

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Three Learning
Products
Koollab Lms
CVE-2026-63239

Hard-coded AWS IAM credentials vulnerability

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Three Learning
Products
Koollab Lms
CVE-2026-63240

Information disclosure vulnerability

An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Three Learning
Products
Koollab Lms
CVE-2026-63241

Insecure direct object reference vulnerability

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Three Learning
Products
Koollab Lms
CVE-2026-63242

Business logic vulnerability

A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Three Learning
Products
Koollab Lms