Loading story…
Skillable's hosted SCORM lab provisioning service was found vulnerable to CVE-2026-56877, a CWE-639 authorization flaw in which the browser-supplied userId parameter on GET /scorm/launch was not validated against the authenticated session token. An authenticated learner could alter that parameter to bypass per-user launch limits, start concurrent labs, and consume another learner's allocation, causing cross-user denial of service. The issue was confirmed against the reporter's own account and a consenting fellow student's account, and Skillable indicated the same weakness could also affect exam allocations and potentially expose another learner's active or saved session details.
Skillable said the affected path is part of its hosted platform and that no server-side fix is planned for the SCORM launch flow, instead recommending customers move to API-based or LTI 1.3 integrations. The vulnerability was assigned a CVSS 3.1 score of 6.5 and later drew discussion on the oss-security mailing list, where moderators noted the disclosure was off-topic because it involved a hosted service rather than open-source software; the thread also pointed to CVE Program guidance that cloud-service flaws may still receive CVEs when customer action is required.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
In a follow-up thread, an oss-security moderator said the Skillable issue was off-topic for the mailing list because it affected a hosted service rather than open source software. The same post noted MITRE had assigned a CVE and cited CVE Program guidance allowing cloud-service vulnerabilities to receive CVEs when customer action is required.
Skillable stated that no server-side fix was planned for the affected hosted SCORM launch flow and instead recommended customers migrate to API-based or LTI 1.3 integrations. The disclosure also noted the same weakness could affect exam allocations and potentially expose another learner's active or saved session details.
A vulnerability in Skillable's hosted SCORM lab provisioning service was disclosed in which the browser-supplied userId parameter was not validated against the SCORM launch token. The issue enabled launch-allocation bypass, concurrent lab launches, and cross-user denial of service, and was identified as CVE-2026-56877.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
payloadforge.io
Open sourceseclists.org
Open sourcegithub.com
Open sourceseclists.org
Open sourceseclists.org
Open sourcecve.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Three Learning's **Koollab LMS 5.3.2** was disclosed with multiple high-severity vulnerabilities that can expose databases, enable account takeover, and lead to remote code execution. The most critical issues include **pre-authentication SQL injection** in the SSO OAuth endpoint (`CVE-2026-63229`) and SCORM report endpoint (`CVE-2026-63230`), which allow unauthenticated attackers to read sensitive database contents such as personally identifiable information, credentials, and valid JWT tokens. A **post-authentication SQL injection** in the face-to-face runs update endpoint (`CVE-2026-63231`) can also expose the full application database and help attackers obtain JWTs for takeover of user accounts. The advisory also details several paths to **server-side code execution**. An unrestricted SCORM upload flaw (`CVE-2026-63227`) lets an authenticated module designer place a PHP webshell in a publicly accessible directory, while two SQL injection and unsafe deserialization chains in the assessment reinforcement and manual mark assessment endpoints (`CVE-2026-63232`, `CVE-2026-63234`) allow authenticated attackers to influence data passed to `unserialize()`, write webshells, and execute arbitrary code on the server. Singapore's Cyber Security Agency said the broader disclosure covers **16 vulnerabilities** across remote code execution, authentication bypass, access control, information disclosure, and business logic weaknesses, and that fixes were rolled out to all cloud-hosted SaaS instances by Three Learning.
Jul 29, 2026
A critical stored cross-site scripting flaw in the open-source conference management platform **pretalx** exposed conference call-for-papers systems to organizer-session compromise. Tracked as **`CVE-2026-41241`** and rated **CVSS 8.7**, the bug allowed low-privileged attackers to place malicious HTML or JavaScript in searchable fields including submission titles, speaker display names, usernames, and email addresses. When an organizer searched for the tainted record, the payload could execute in that organizer’s browser, enabling theft of visible data, access to CSRF tokens, and authenticated actions that effectively granted organizer-level control. Researcher **Elad Meged** of Novee reported the issue after validating the vulnerable workflow across roughly 40 conferences without deploying live exploit payloads against real targets, while exploit testing was kept to controlled local environments. The report said attackers could also chain the bug with a Content Security Policy bypass by uploading a JavaScript payload disguised as presentation material, and described a no-JavaScript variant that could demote administrators via a superuser-demotion endpoint triggered from an embedded image tag. Pretalx developer Tobias Kunze said 11 findings were reported on April 14, with one deemed serious, and the project fixed the vulnerability in **`v2026.1.0`**; researchers also warned that agentic AI could help identify exposed pretalx instances and scale validation or exploitation.
Jun 29, 2026
Adobe disclosed two high-severity vulnerabilities in **Adobe Connect** affecting versions **2025.3, 12.10, and earlier**, and directed customers to advisory **`APSB26-37`** for remediation. One issue, **`CVE-2026-27246`**, is a DOM-based cross-site scripting flaw classified as **`CWE-79`** that can let an attacker manipulate the browser DOM and run malicious JavaScript in a victim’s session after luring the user to a crafted webpage. The vulnerability carries a CVSS v3.1 vector of **`AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`**, indicating network reachability, low attack complexity, no privileges required, and high confidentiality and integrity impact. Adobe also disclosed **`CVE-2026-34615`**, a **`CWE-502`** deserialization of untrusted data vulnerability in the same product versions that can lead to arbitrary code execution in the context of the current user. Adobe said exploitation of the deserialization flaw does not require user interaction, making it the more serious of the two issues, while both bugs were published through Adobe’s PSIRT process and affect the same supported and earlier Adobe Connect releases. Organizations using Adobe Connect should prioritize patching exposed deployments and reviewing the vendor advisory for fixed versions and mitigation guidance.
Jun 29, 2026