CVE-2026-63230

Name of the Vulnerable Software and Affected Versions Koollab LMS (affected versions not specified)

Description A pre-authentication error-based SQL injection allows an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT (JSON Web Tokens) which are compact, URL-safe means of representing claims to be transferred between two parties. This could lead to account takeover via the SCORM report endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.