129437 matches found
CVE-2026-63241
Koollab LMS is affected by an insecure direct object reference vulnerability that allows an authenticated user to query the course completion progress of other users without proper authorization, leading to disclosure of private learning progress information. The root cause is an insecure direct ...
EUVD-2026-50135
An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments...
CVE-2026-63240
Technical details (affected software/versions, root cause, fix) are not publicly provided in the supplied documents. Monitor for updates from official sources.
CVE-2026-63240 Information disclosure vulnerability
An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments...
CVE-2026-63240
An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments...
EUVD-2026-50129
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...
EUVD-2026-50128
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...
CVE-2026-63233
CVE-2026-63233 is a SQL injection and unsafe deserialization vulnerability in Koollab LMS. The issue affects the assessment overall answer endpoint, where an authenticated attacker can inject SQL and influence data passed to unserialize(), potentially writing a webshell to a publicly accessible l...
CVE-2026-63233
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...
EUVD-2026-50127
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...
CVE-2026-63232 SQL injection and unsafe deserialisation vulnerability
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...
CVE-2026-63232
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...
CVE-2026-63231 Post-authentication SQL injection vulnerability
A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...
EUVD-2026-50126
A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...
CVE-2026-63228
An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feedback mail registration endpoint, potentially enabling further attacks on the server...
EUVD-2026-50123
An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feedback mail registration endpoint, potentially enabling further attacks on the server...
CVE-2026-63228 Unrestricted image upload vulnerability
An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feedback mail registration endpoint, potentially enabling further attacks on the server...
CVE-2026-63227
An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server...
EUVD-2026-50122
An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server...
CVE-2026-63227 Unrestricted SCORM file upload vulnerability
An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server...