CVE-2026-63230
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Koollab LMS has a pre-authentication error-based SQL injection vulnerability in the SCORM report endpoint. An unauthenticated attacker can read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens, potentially enabling account takeover.
Risk Assessment
An attacker could access sensitive user data, potentially leading to identity theft, privacy breaches, and unauthorized account access.
Recommendation
Immediately update Koollab LMS to the latest version that fixes this vulnerability, and consider additional security measures such as input filtering.
Original NVD description (English source)
A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint.