SQL Injection and Unsafe Deserialization Vulnerability in Koollab LMS

CVE-2026-63234

What is CVE-2026-63234?

A vulnerability in Koollab LMS allows authenticated attackers to exploit the manual mark assessment endpoint via SQL injection and unsafe deserialization. This flaw can enable attackers to manipulate data passed to the unserialize() function, potentially allowing them to write a web shell to a publicly accessible location, leading to the execution of arbitrary code on the server. Organizations using Koollab LMS should review their systems and apply necessary updates to mitigate potential risks.

References