Three Learning Koollab Lms vulnerabilities

• an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lms Business logic vulnerability CVE-2026-63242 4.3 MediumJuly 29, 2026
• an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lms Insecure direct object reference vulnerability CVE-2026-63241 3.1 LowJuly 29, 2026
• an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lms Information disclosure vulnerability CVE-2026-63240 4.3 MediumJuly 29, 2026
• an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lms Hard-coded AWS IAM credentials vulnerability CVE-2026-63239 5.4 MediumJuly 29, 2026
• an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lms Authentication bypass vulnerability CVE-2026-63238 6.5 MediumJuly 29, 2026
• an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lms TOTP two-factor authentication bypass vulnerability CVE-2026-63237 4.8 MediumJuly 29, 2026
• an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lms Improper access control vulnerability CVE-2026-63236 3.7 LowJuly 29, 2026
• an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lms Improper access control vulnerability CVE-2026-63235 3.7 LowJuly 29, 2026
• an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lms SQL injection and unsafe deserialisation vulnerability CVE-2026-63234 9.9 CriticalJuly 29, 2026
• an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lms SQL injection and unsafe deserialisation vulnerability CVE-2026-63233 9.9 CriticalJuly 29, 2026
• an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lms SQL injection and unsafe deserialisation vulnerability CVE-2026-63232 9.9 CriticalJuly 29, 2026
• an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lms Post-authentication SQL injection vulnerability CVE-2026-63231 8.1 HighJuly 29, 2026
• an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lms Pre-authentication error-based SQL injection vulnerability CVE-2026-63230 9.1 CriticalJuly 29, 2026
• an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lms Pre-authentication blind SQL injection vulnerability CVE-2026-63229 9.1 CriticalJuly 29, 2026
• an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lms Unrestricted image upload vulnerability CVE-2026-63228 2.6 LowJuly 29, 2026