{"id":"CVE-2026-63230","state":"PUBLISHED","title":"Pre-authentication error-based SQL injection vulnerability","description":"A pre-authentication error-based SQL injection\nvulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database\ncontents, including personally identifiable information, credentials, and valid\nJWT tokens that may enable account takeover, via the SCORM report endpoint.","publishedAt":"2026-07-29T06:11:58.862Z","updatedAt":"2026-07-29T15:23:22.173Z","severity":{"score":9.1,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"CSA"},"assigner":"CSA","products":["Three Learning Koollab LMS"],"affected":[{"vendor":"Three Learning","product":"Koollab LMS","defaultStatus":"unaffected","versions":[{"version":"5.3.2","status":"affected"}]}],"references":["https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/63xxx/CVE-2026-63230.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63230","state":"PUBLISHED","datePublished":"2026-07-29T06:11:58.862Z","dateUpdated":"2026-07-29T15:23:22.173Z","assignerShortName":"CSA","assignerOrgId":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","dateReserved":"2026-07-16T02:33:02.673Z"},"containers":{"cna":{"title":"Pre-authentication error-based SQL injection vulnerability","descriptions":[{"lang":"en","value":"A pre-authentication error-based SQL injection\nvulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database\ncontents, including personally identifiable information, credentials, and valid\nJWT tokens that may enable account takeover, via the SCORM report endpoint."}],"affected":[{"vendor":"Three Learning","product":"Koollab LMS","defaultStatus":"unaffected","versions":[{"version":"5.3.2","status":"affected"}]}],"references":[{"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseSeverity":"CRITICAL","baseScore":9.1,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}}],"providerMetadata":{"shortName":"CSA","orgId":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","dateUpdated":"2026-07-29T06:11:58.862Z"},"datePublic":"2026-07-29T06:07:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.4"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-29T15:11:34.025490Z","id":"CVE-2026-63230","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-29T15:23:22.173Z"}}]}}}