Three Learning vulnerabilities
We track 6 vulnerabilities in Three Learning products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on July 29, 2026.
Latest Three Learning vulnerabilities
- 9.9 Critical severity
Koollab LMS: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execu
- 9.9 Critical severity
Koollab LMS: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and ex
- 9.9 Critical severity
Koollab LMS: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and exe
- 8.1 High severity
Koollab LMS: Improper Neutralization of Special Elements used in an SQL Command
A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeov
- 9.1 Critical severity
Koollab LMS: Improper Neutralization of Special Elements used in an SQL Command
A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeov
- 9.1 Critical severity
Koollab LMS: Improper Neutralization of Special Elements used in an SQL Command
A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials,