CVE-2026-63232
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Koollab LMS has a SQL injection and unsafe deserialization vulnerability in the assessment reinforcement endpoint. An authenticated attacker can inject SQL, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
Risk Assessment
An attacker could gain full control of the server, potentially leading to data theft, content modification, or further attacks on the infrastructure.
Recommendation
Immediately update Koollab LMS to the latest version that fixes these vulnerabilities, and perform a security audit of the application.
Original NVD description (English source)
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.