CVE-2026-63242 | Medium | 4.3 | 2026-07-29 | A business logic vulnerability in Koollab LMS
allowed an
authenticated learner to set their lesson completion status to completed via
the SCORM commit endpoint… |
CVE-2026-63241 | Low | 3.1 | 2026-07-29 | An insecure direct object reference
vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress
of any other user withou… |
CVE-2026-63240 | Medium | 4.3 | 2026-07-29 | An information disclosure vulnerability in Koollab LMS allowed an authenticated learner
to obtain correct quiz answers from the course status endpoint without
… |
CVE-2026-63239 | Medium | 5.4 | 2026-07-29 | A hard-coded AWS IAM credentials vulnerability
in Koollab LMS allowed
an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing
sensitive d… |
CVE-2026-63238 | Medium | 6.5 | 2026-07-29 | An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated
attacker to take over any account, including administrator accounts, by
supply… |
CVE-2026-63237 | Medium | 4.8 | 2026-07-29 | A TOTP two-factor authentication bypass vulnerability in
Koollab LMS allowed an
attacker to supply a client-controlled seed to generate a matching one-time
pas… |
CVE-2026-63236 | Low | 3.7 | 2026-07-29 | An improper access control vulnerability in
Koollab LMS allowed an
unauthenticated attacker to read another user's name, internal identifier,
scores, lesson st… |
CVE-2026-63235 | Low | 3.7 | 2026-07-29 | An improper access control vulnerability in Koollab LMS
allowed an
unauthenticated attacker to forcibly terminate the session of any user given
their email add… |
CVE-2026-63234 | Critical | 9.9 | 2026-07-29 | A SQL injection and unsafe deserialisation
vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark
assessment endpoint… |
CVE-2026-63233 | Critical | 9.9 | 2026-07-29 | A SQL injection and unsafe deserialisation
vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment
overall answer endpo… |
CVE-2026-63232 | Critical | 9.9 | 2026-07-29 | A SQL injection and unsafe deserialisation
vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment
reinforcement endpoi… |
CVE-2026-63231 | High | 8.1 | 2026-07-29 | A post-authentication SQL injection
vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via
the face-to-face runs u… |
CVE-2026-63230 | Critical | 9.1 | 2026-07-29 | A pre-authentication error-based SQL injection
vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database
contents, including… |
CVE-2026-63229 | Critical | 9.1 | 2026-07-29 | A pre-authentication blind SQL injection
vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via
the SSO OAuth endp… |
CVE-2026-63228 | Low | 2.6 | 2026-07-29 | An unrestricted image upload vulnerability in
Koollab LMS allowed
an authenticated attacker to upload malicious content disguised as an image
file via the feed… |
CVE-2026-3007 | Medium | 5.4 | 2026-04-23 | Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that… |