A SQL injection and unsafe deserialisation
vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment
reinforcement endpoin…

A critical vulnerability identified as CVE-2026-63232 affects Koollab LMS, combining SQL injection with unsafe deserialisation. An authenticated attacker can exploit the assessment reinforcement endpoint to inject malicious data, manipulate inputs passed to PHP's unserialize() function, and ultimately achieve remote code execution. The attack chain allows writing a webshell to a publicly accessible server location, granting persistent access. The vulnerability requires authentication but is considered high severity due to its RCE impact. It has been reported by NVD (NIST) and flagged by Singapore's Cyber Security Agency (CSA) as an active advisory.