Exploitation ongoing with high activity in latest observed window (2 mentions)
Recommended action window: Immediate (within 24h)
NVD description
A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-63231 Post-Authentication SQL Injection in Koollab LMS Face-to-Face Runs Update Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-63231
Post summary
The post references CVE-2026-63231, revealing a post-authentication SQL injection flaw in Koollab LMS's Face-to-Face Runs Update endpoint, but provides no PoC, exploit, or remediation details.
Our CTI team identified a lot of activities targeting Three Learning Koollab LMS (CVE-2026-63231) https://vuldb.com/vuln/384065/cti
Post summary
CTI team reports widespread activity targeting CVE-2026-63231, indicating it is currently being exploited in the wild.