CVE-2026-63230: falha crítica em Three Learning Koollab LMS
Pre-authentication error-based SQL injection vulnerability
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.5%
A pre-authentication error-based SQL injection
vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database
contents, including personally identifiable information, credentials, and valid
JWT tokens that may enable account takeover, via the SCORM report endpoint.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
Three Learning · Koollab LMSCVEs relacionadas — Three Learning Koollab LMS
No mesmo produto, das mais perigosas para as menos.
CVE-2026-63234CRITICALSQL injection and unsafe deserialisation vulnerabilityEPSS 0.5%CVE-2026-63233CRITICALSQL injection and unsafe deserialisation vulnerabilityEPSS 0.5%CVE-2026-63232CRITICALSQL injection and unsafe deserialisation vulnerabilityEPSS 0.5%CVE-2026-63229CRITICALPre-authentication blind SQL injection vulnerabilityEPSS 0.5%CVE-2026-63231HIGHPost-authentication SQL injection vulnerabilityEPSS 0.4%CVE-2026-63238MEDIUMAuthentication bypass vulnerabilityEPSS 0.3%