← CVE Intelligence

CVE-2026-63233

SQL injection and unsafe deserialisation vulnerability PUBLISHED

Description (CNA)

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.

Affected (CNA)

Vendor / productVersions
Three Learning / Koollab LMSaffected 5.3.2

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.