Loading story…
Three Learning's Koollab LMS 5.3.2 was disclosed with multiple high-severity vulnerabilities that can expose databases, enable account takeover, and lead to remote code execution. The most critical issues include pre-authentication SQL injection in the SSO OAuth endpoint (CVE-2026-63229) and SCORM report endpoint (CVE-2026-63230), which allow unauthenticated attackers to read sensitive database contents such as personally identifiable information, credentials, and valid JWT tokens. A post-authentication SQL injection in the face-to-face runs update endpoint (CVE-2026-63231) can also expose the full application database and help attackers obtain JWTs for takeover of user accounts.
The advisory also details several paths to server-side code execution. An unrestricted SCORM upload flaw (CVE-2026-63227) lets an authenticated module designer place a PHP webshell in a publicly accessible directory, while two SQL injection and unsafe deserialization chains in the assessment reinforcement and manual mark assessment endpoints (CVE-2026-63232, CVE-2026-63234) allow authenticated attackers to influence data passed to unserialize(), write webshells, and execute arbitrary code on the server. Singapore's Cyber Security Agency said the broader disclosure covers 16 vulnerabilities across remote code execution, authentication bypass, access control, information disclosure, and business logic weaknesses, and that fixes were rolled out to all cloud-hosted SaaS instances by Three Learning.
See affected versions and whether adversaries are exploiting it.
9 events from the most recent confirmed update back to the earliest known activity.
A CVE record was published for a vulnerability in the manual mark assessment endpoint of Koollab LMS 5.3.2 that combines SQL injection and unsafe deserialization, enabling webshell upload and arbitrary code execution.
A CVE record was published for a vulnerability in the assessment reinforcement endpoint of Koollab LMS 5.3.2 that chains SQL injection with unsafe deserialization to write a webshell and execute code.
A CVE record was published for a post-authentication SQL injection flaw in the face-to-face runs update endpoint of Koollab LMS 5.3.2 that can expose the full application database and enable JWT theft for account takeover.
A CVE record was published for a pre-authentication error-based SQL injection vulnerability in the SCORM report endpoint of Koollab LMS 5.3.2, enabling unauthenticated access to sensitive database contents.
A CVE record was published for a pre-authentication blind SQL injection flaw in the SSO OAuth endpoint of Koollab LMS 5.3.2 that can expose sensitive database contents and valid JWT tokens.
A CVE record was published for an unrestricted SCORM file upload flaw in Koollab LMS 5.3.2 that allows an authenticated module designer to upload a PHP webshell and achieve arbitrary code execution.
On 2026-04-14, Singapore's Cyber Security Agency disclosed that Koollab LMS version 5.3.2 was affected by 16 vulnerabilities spanning remote code execution, SQL injection, authentication bypass, access control flaws, information disclosure, and business logic weaknesses.
The CSA advisory states the Koollab LMS vulnerability information was publicly released on 2026-07-29.
Three Learning stated that fixes for the disclosed Koollab LMS vulnerabilities were rolled out to all cloud-hosted SaaS instances on 2026-04-26.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecsa.gov.sg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT Polska disclosed three vulnerabilities in **LMS (LAN Management System)**, including two high-severity issues tracked as `CVE-2026-40455` and `CVE-2026-40456`. The first is an authenticated SQL injection in `tarifflist.php` before commit `4cb30a7`, caused by insufficient sanitization of the POST `tg[]` parameter and unsafe query construction with `implode()`, allowing attackers to extract sensitive database information. The second is an OS command injection before commit `9fcb4de`, where an IP address parameter is passed to `exec()` without proper validation, enabling arbitrary operating system command execution. CERT Polska also reported `CVE-2026-40457`, a reflected XSS flaw in `dbrecover.php` and `netremap.php` before commit `9c5651b` that can trigger arbitrary JavaScript execution when an authenticated user opens a crafted link under certain conditions. The SQL injection and command injection bugs were both rated **High** with CVSS 4.0 base scores of **8.6**, and the disclosure credited **Tymoteusz Dominik** for responsibly reporting the issues. Organizations running LMS versions prior to the referenced commits should prioritize patching and review exposure of authenticated administrative functions.
Jun 29, 2026
Chamilo LMS disclosed high-severity unrestricted file upload vulnerabilities, `CVE-2023-4225` and `CVE-2023-4226`, in `/main/inc/ajax/exercise.ajax.php` and `/main/inc/ajax/work.ajax.php`. The flaws affect versions up to and including `1.11.24` and allow an authenticated user with learner privileges to upload arbitrary files into the web-accessible `/app/cache` directory. By uploading PHP files and modifying `.htaccess`, an attacker can enable code execution on the server and run commands with the web server's privileges; STAR Labs demonstrated exploitation with a PHP web shell executing as `www-data`. The advisories said the vulnerable logic trusted user-supplied filenames without adequate restriction and noted similar issues in related Chamilo AJAX handlers tracked as `CVE-2023-4223` and `CVE-2023-4224`. Beyond remote code execution, the same weakness can also support stored cross-site scripting through uploaded HTML content. Chamilo addressed the issues in version `1.11.26`, and defenders were urged to review requests to the affected endpoints and access to `/app/cache` for signs of compromise.
Jun 29, 2026
Skillable's hosted SCORM lab provisioning service was found vulnerable to **CVE-2026-56877**, a `CWE-639` authorization flaw in which the browser-supplied `userId` parameter on `GET /scorm/launch` was not validated against the authenticated session token. An authenticated learner could alter that parameter to bypass per-user launch limits, start concurrent labs, and consume another learner's allocation, causing cross-user denial of service. The issue was confirmed against the reporter's own account and a consenting fellow student's account, and Skillable indicated the same weakness could also affect exam allocations and potentially expose another learner's active or saved session details. Skillable said the affected path is part of its hosted platform and that no server-side fix is planned for the SCORM launch flow, instead recommending customers move to API-based or **LTI 1.3** integrations. The vulnerability was assigned a **CVSS 3.1 score of 6.5** and later drew discussion on the `oss-security` mailing list, where moderators noted the disclosure was off-topic because it involved a hosted service rather than open-source software; the thread also pointed to CVE Program guidance that cloud-service flaws may still receive CVEs when customer action is required.
Jul 16, 2026