CVE-2026-63231
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
Jul 29, 2026
Vendor
unknown
Description
A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover.