Is CVE-2026-63231 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-63231?

CVE-2026-63231 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-63231

Description

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover.