What is CVE-2026-63230?

CVE-2026-63230 is a critical-severity vulnerability in Three Learning Koollab Lms, classified under SQL Injection. CVSS score: 9.1/10. Published 2026-07-29.

How severe is CVE-2026-63230?

Critical severity. CVSS v3 base score is 9.1 out of 10.

SQL Injection in Three Learning Koollab Lms

CVE-2026-63230

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint.

Vulnerability class: SQL Injection

EPSS: 0.003 (22.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Three Learning Koollab Lms — versions 5.3.2

Weakness classification (CWE)

CWE-89 — SQL Injection

References

5f57b9bf-260d-4433-bf07-b6a79e9bb7d4

Frequently asked questions

What is CVE-2026-63230?: CVE-2026-63230 is a critical-severity vulnerability in Three Learning Koollab Lms, classified under SQL Injection. CVSS score: 9.1/10. Published 2026-07-29.
How severe is CVE-2026-63230?: Critical severity. CVSS v3 base score is 9.1 out of 10.