CVE-2026-63234 — SQL injection and unsafe deserialisation vulnerability
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data pas…
Published: 2026-07-29 · CVSS: 9.9 · CVSS 3.1
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7