What is the CVSS score of CVE-2026-3007?

CVE-2026-3007 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Koollab Learning Management System CVE-2026-3007

EUVD-2026-25170 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-23 CSA

GHSA-p88x-88cf-mv94

XSS Koollab Learning Management System

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 23, 2026 - 07:02 vuln.today

EUVD ID Assigned

Apr 23, 2026 - 04:00 euvd

EUVD-2026-25170

Analysis Generated

Apr 23, 2026 - 04:00 vuln.today

CVE Published

Apr 23, 2026 - 02:54 nvd

MEDIUM 5.4

DescriptionCVE.org

Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS’ courselet feature.

AnalysisAI

Stored cross-site scripting (XSS) in Koollab LMS courselet feature allows authenticated users to inject arbitrary JavaScript that executes in the browsers of other users with courselet access, potentially compromising account security and enabling credential theft or malicious actions on behalf of affected users. CVSS 5.4 reflects network delivery, low complexity, and limited confidentiality/integrity impact constrained by required user interaction and authenticated access.

Technical ContextAI

The vulnerability exists in the courselet feature of Koollab Learning Management System, a web-based educational platform by Three Learning. The XSS is stored (persistent), meaning malicious JavaScript payloads are saved in the application's database and executed whenever authenticated users view the affected courselet content. This is a CWE-79 (Improper Neutralization of Input During Web Page Generation) variant where user-supplied input in courselets is not properly sanitized or encoded before being reflected in HTML responses. The CPE cpe:2.3:a:three_learning:koollab_learning_management_system:*:*:*:*:*:*:*:* indicates the vulnerability affects the core LMS product across versions.

RemediationAI

Contact Three Learning for a patched version of Koollab LMS above 5.3.2 or monitor the CSA alert (https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-042/) for vendor patch release timelines. If a patched version is not immediately available, implement input validation and output encoding on courselet content fields: disable HTML input in courselet descriptions and titles, or employ a strict Content Security Policy (CSP) header with script-src 'self' and nonce-based inline script whitelisting to mitigate stored XSS impact. Additionally, restrict courselet creation/editing permissions to trusted administrator roles and audit courselet modification logs for suspicious payloads. User awareness training on not clicking untrusted courselet links and using browser security extensions (e.g., XSS filters) provides defense-in-depth, though these do not eliminate the underlying vulnerability.