CVEvulnerability

CVE-2026-63229

9.1 CRITICAL Published 2026-07-29 Modified 2026-10-23 Official page ↗
Status
Deferred
Published
2026-07-29
Last modified
2026-10-23
Assigner
5f57b9bf-260d-4433-bf07-b6a79e9bb7d4
CVSS 3.1 (5f57b9bf-260d-4433-bf07-b6a79e9bb7d4)
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-89

Description

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover.

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References