Koollab LMS vulnerabilities
6 known vulnerabilities in Koollab LMS from Three Learning. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.9 Critical severity
Koollab LMS: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execu
- 9.9 Critical severity
Koollab LMS: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and ex
- 9.9 Critical severity
Koollab LMS: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and exe
- 8.1 High severity
Koollab LMS: Improper Neutralization of Special Elements used in an SQL Command
A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeov
- 9.1 Critical severity
Koollab LMS: Improper Neutralization of Special Elements used in an SQL Command
A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeov
- 9.1 Critical severity
Koollab LMS: Improper Neutralization of Special Elements used in an SQL Command
A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials,