CVE-2026-63230CWE-89sql-injection

CVE-2026-63230

Critical · published July 29, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
43.5
In the wild
Unconfirmed
What it is

A pre-authentication error-based SQL injection

vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database

contents, including personally identifiable information, credentials, and valid

JWT tokens that may enable account takeover, via the SCORM report endpoint.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00522 · 43.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-07-29T11:16Z
References (1)
https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/ · 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4
EPSS history
Timeline
  • 29 JUL 06:11Z
    Pre-authentication error-based SQL injection vulnerability
    cvelistv5