14 matches found
CVE-2026-63242
A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records...
CVE-2026-63242 Business logic vulnerability
A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records...
EUVD-2026-50137
A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records...
CVE-2026-63242
Koollab LMS is affected by a business logic vulnerability that lets an authenticated learner set their lesson completion to completed via the SCORM commit endpoint without viewing the material. This affects training/completion records and is rated CVSS v3.1 base score 4.3 (Medium) with PR:L, UI:N...
CVE-2026-63242
A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records...
PT-2026-65713
A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records...
CVE-2026-5387
The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer Administrator roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, an...
EUVD-2026-22979
The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer Administrator roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, an...
CVE-2026-5387
The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer Administrator roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, an...
CVE-2026-5387
The CVE-2026-5387 entry concerns AVEVA Pipeline Simulation where an unauthenticated actor can perform operations intended for Simulator Instructor/Developer (Administrator) roles, leading to privilege escalation and potential modification of simulation parameters, training configuration, and trai...
CVE-2026-5387 AVEVA Pipeline Simulation Missing Authorization
The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer Administrator roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, an...
CVE-2026-5387
The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer Administrator roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, an...
PT-2026-33078
Name of the Vulnerable Software and Affected Versions AVEVA Pipeline Simulation affected versions not specified Description An issue exists where unauthenticated network access allows a remote attacker to perform operations intended only for Simulator Instructor or Simulator Developer Administrat...
2 Men Linked to China’s Salt Typhoon Hacker Group Likely Trained in a Cisco ‘Academy’
The names of two partial owners of firms linked to the Salt Typhoon hacker group also appeared in records for a Cisco training program—years before the group targeted Cisco’s devices in a spy campaign...