CVE-2026-63230

{
  "id": "CVE-2026-63230",
  "sourceIdentifier": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
  "published": "2026-07-29T07:16:42.373",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A pre-authentication error-based SQL injection\nvulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database\ncontents, including personally identifiable information, credentials, and valid\nJWT tokens that may enable account takeover, via the SCORM report endpoint."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección SQL basada en errores de preautenticación en Koollab LMS permitió a un atacante no autenticado leer contenido sensible de la base de datos, incluyendo información de identificación personal, credenciales y tokens JWT válidos que podrían permitir la toma de control de cuentas, a través del punto final de informe SCORM."
    }
  ],
  "affected": [
    {
      "source": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
      "affectedData": [
        {
          "vendor": "Three Learning",
          "product": "Koollab LMS",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "5.3.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-29T15:11:34.025490Z",
          "id": "CVE-2026-63230",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/",
      "source": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4"
    }
  ]
}