CVE-2026-63233

Name of the Vulnerable Software and Affected Versions Koollab LMS (affected versions not specified)

Description An authenticated attacker can exploit a SQL injection and unsafe deserialization issue via the assessment overall answer endpoint. By controlling data passed to the unserialize() function, the attacker can write a webshell to a publicly accessible location and execute arbitrary code on the server. Unsafe deserialization occurs when untrusted data is used to abuse the logic of an application to execute arbitrary code or tamper with data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.