CVE-2026-63227

CriticalCVSS 9.9/10Last modified Jul 30, 2026

Description

An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Jul 29, 2026
Last modified
Jul 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-632282.6An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an imagCVE-2026-632299.1A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle viaCVE-2026-632309.1A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database cCVE-2026-632318.1A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the CVE-2026-632329.9A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment rCVE-2026-632339.9A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment oCVE-2026-632349.9A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark CVE-2026-632353.7An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user giCVE-2026-632363.7An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifierCVE-2026-632374.8A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a maCVE-2026-632386.5An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator CVE-2026-632395.4A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, e
CVE-2026-63227: Critical severity, CVSS 9.9 | Vulnix