Koollab Lms

Integrity compromise in Koollab LMS allows authenticated learners to falsify lesson completion records via the SCORM commit endpoint without viewing material. Affects version 5.3.2, compromising training and compliance records. No public exploit or active exploitation identified at time of analysis.

Information disclosure in Koollab LMS allows authenticated users to access other users' course completion data without authorization. The vulnerability

Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requiring legitimate assessment completion. An attacker with a valid student account can retrieve answers and compromise exam integrity.

Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to access shared multi-tenant S3 buckets and SQS queues, leading to sensitive data disclosure, content injection, and job manipulation. No public exploit or active exploitation has been identified at the time of analysis.

An authentication bypass in Koollab LMS allows unauthenticated attackers to take over any account, including administrator accounts, by supplying a valid user UUID to the 2FA validation endpoint without providing primary credentials. Affected version 5.3.2 (and potentially earlier versions) exposes sensitive data and permits limited modification once an account is compromised. No active exploitation or public exploit code is known at the time of analysis.

Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a valid one-time password, bypassing the second authentication factor. This can lead to unauthorized access to administrator accounts if TOTP is enabled. No public exploit or active exploitation has been identified at time of analysis.

Information disclosure in Koollab LMS 5.3.2 allows unauthenticated remote attackers to access sensitive user data (name, internal identifier, scores, lesson status, position, and cached state) via the SCORM API due to improper access controls. No exploit code or active exploitation is known, and the base CVSS score of 3.7 reflects low impact.

Forced session termination via the login kickout endpoint in Koollab LMS allows unauthenticated attackers to deny service to any user by knowing their email address. The vulnerability, assigned a low CVSS score of 3.7, does not compromise data but can disrupt user sessions. No active exploitation or public proof-of-concept has been reported at the time of analysis.

Remote code execution in Koollab LMS 5.3.2 lets an authenticated attacker chain SQL injection (CWE-89) and PHP object injection through the manual mark assessment endpoint to poison data reaching unserialize(), drop a webshell into a web-accessible path, and run arbitrary commands on the host. The chained SQLi-to-deserialization-to-webshell path yields total system compromise (CVSS 9.9, scope change). There is no public exploit identified at time of analysis, EPSS is low (0.30%), and CISA SSVC currently rates exploitation as none.

Remote code execution in Koollab LMS allows authenticated attackers to chain SQL injection with unsafe deserialization, ultimately executing arbitrary commands on the server. The vulnerability is reachable via the assessment overall answer endpoint and permits writing a webshell to a publicly accessible location. No active exploitation (KEV) or public exploit code has been confirmed at this time.

Remote code execution in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe deserialization through the assessment reinforcement endpoint, resulting in webshell upload and full server compromise. The vulnerability, tracked as CVE-2026-63232, requires low-privileged access but leads to complete takeover of the server. No public exploit or active exploitation has been identified at time of analysis.

Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoint as a SQL oracle to exfiltrate the entire application database, including valid JWT tokens that enable full account takeover. Rated CVSS 8.1 with high confidentiality and integrity impact; there is no public exploit identified at time of analysis and EPSS is low at 0.25% (17th percentile). SSVC scores technical impact as total but exploitation as none, indicating no observed use so far.

Error-based SQL injection in Koollab LMS allows unauthenticated attackers to exfiltrate sensitive database contents, including user credentials and JWT tokens that may enable account takeover. The vulnerability, reported through Singapore’s CSA, affects the SCORM report endpoint and does not require prior authentication. No public exploit code or active exploitation data (KEV, EPSS) has been observed at the time of analysis, but the high CVSS score and low attack complexity make it a serious risk if the endpoint is exposed.

Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, including credentials and JWT tokens, through its SSO OAuth endpoint without user interaction. This critical flaw (CVSS 9.1) can lead to full account takeover, but no public exploit or active exploitation has been confirmed at this time.

File upload restriction bypass in Ko

Arbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full server compromise by uploading a malicious SCORM package containing a PHP webshell. The uploaded file is placed in a publicly accessible directory, enabling the attacker to execute arbitrary commands on the underlying server. No evidence of active exploitation or public exploit code exists at this time, but the CVSS score of 9.9 reflects critical severity.