A SQL injection and unsafe deserialisation
vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark
assessment endpoint, control data passed to unserialize(), write a webshell to
a publicly accessible location, and execute arbitrary code on the server.
vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark
assessment endpoint, control data passed to unserialize(), write a webshell to
a publicly accessible location, and execute arbitrary code on the server.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Three Learning | Koollab LMS | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 29 Jul 2026 06:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server. | |
| Title | SQL injection and unsafe deserialisation vulnerability | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CSA
Published:
Updated: 2026-07-29T06:22:01.996Z
Reserved: 2026-07-16T02:33:02.674Z
Link: CVE-2026-63234
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.