Koollab Lms EUVD-2026-50131

Arbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full s

Remote code execution in Koollab LMS 5.3.2 lets an authenticated attacker chain SQL injection (CWE-89) and PHP object in

Remote code execution in Koollab LMS allows authenticated attackers to chain SQL injection with unsafe deserialization,

Remote code execution in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe deserialization

Error-based SQL injection in Koollab LMS allows unauthenticated attackers to exfiltrate sensitive database contents, inc

Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, includin

Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoin

An authentication bypass in Koollab LMS allows unauthenticated attackers to take over any account, including administrat

Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to ac

Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a

Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requ

Integrity compromise in Koollab LMS allows authenticated learners to falsify lesson completion records via the SCORM com