Three Learning Koollab Lms
15 CVEs affecting Three Learning Koollab Lms. Latest disclosed: 2026-07-29. Critical: 5, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63234 | Critical | 9.9 | 2026-07-29 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint… |
CVE-2026-63233 | Critical | 9.9 | 2026-07-29 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpo… |
CVE-2026-63232 | Critical | 9.9 | 2026-07-29 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoi… |
CVE-2026-63230 | Critical | 9.1 | 2026-07-29 | A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including… |
CVE-2026-63229 | Critical | 9.1 | 2026-07-29 | A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endp… |
CVE-2026-63231 | High | 8.1 | 2026-07-29 | A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs u… |
CVE-2026-63238 | Medium | 6.5 | 2026-07-29 | An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supply… |
CVE-2026-63239 | Medium | 5.4 | 2026-07-29 | A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive d… |
CVE-2026-63237 | Medium | 4.8 | 2026-07-29 | A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time pas… |
CVE-2026-63242 | Medium | 4.3 | 2026-07-29 | A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint… |
CVE-2026-63240 | Medium | 4.3 | 2026-07-29 | An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without … |
CVE-2026-63236 | Low | 3.7 | 2026-07-29 | An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson st… |
CVE-2026-63235 | Low | 3.7 | 2026-07-29 | An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email add… |
CVE-2026-63241 | Low | 3.1 | 2026-07-29 | An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user withou… |
CVE-2026-63228 | Low | 2.6 | 2026-07-29 | An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feed… |