CVE-2026-63231 — Post-authentication SQL injection vulnerability
A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to …
Published: 2026-07-29 · CVSS: 8.1 · CVSS 3.1
A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7