CVE-2026-63232 — SQL injection and unsafe deserialisation vulnerability
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data p…
Published: 2026-07-29 · CVSS: 9.9 · CVSS 3.1
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7