CyberRota Analysis
AI-GeneratedA critical SQL injection and unsafe deserialization vulnerability in Koollab LMS allows authenticated attackers to exploit the manual mark assessment endpoint, enabling them to inject malicious code and execute arbitrary commands on the server. This poses a significant risk as it can lead to unauthorized access and control over sensitive data. Organizations using Koollab LMS should prioritize immediate remediation to mitigate potential exploitation.
CVE
CVE-2026-63234
Severity
CRITICAL
CVSS
9.9
EPSS
0.29%
Original NVD Description
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.