# Three Learning Koollab LMS vulnerabilities Source: https://junglewise.ai/threats/technologies/koollab-lms Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/koollab-lms.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in Three Learning Koollab LMS: 0 in the last 7 days and 0 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-63242, was published on 29 July 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 17 (6 critical, 0 exploited in the wild) ## About Three Learning Koollab LMS A learning management system designed for corporate and educational training environments. ## Latest Three Learning Koollab LMS vulnerabilities - [CVE-2026-63242: Three Learning Koollab LMS business logic bypass in SCORM commit endpoint](https://junglewise.ai/threats/cve-2026-63242-three-learning-koollab-lms-business-logic-bypass-in-scorm-commit) (medium, CVSS 4.3, published 29 Jul 2026) - [CVE-2026-63241: Three Learning Koollab LMS IDOR in course completion query](https://junglewise.ai/threats/cve-2026-63241-three-learning-koollab-lms-idor-in-course-completion-query) (low, CVSS 3.1, published 29 Jul 2026) - [CVE-2026-63240: Three Learning Koollab LMS information disclosure in course status endpoint](https://junglewise.ai/threats/cve-2026-63240-three-learning-koollab-lms-information-disclosure-in-course) (medium, CVSS 4.3, published 29 Jul 2026) - [CVE-2026-63239: Three Learning Koollab LMS hard-coded AWS IAM credentials](https://junglewise.ai/threats/cve-2026-63239-three-learning-koollab-lms-hard-coded-aws-iam-credentials) (medium, CVSS 5.4, published 29 Jul 2026) - [CVE-2026-63238: Three Learning Koollab LMS authentication bypass in 2FA endpoint](https://junglewise.ai/threats/cve-2026-63238-three-learning-koollab-lms-authentication-bypass-in-2fa-endpoint) (medium, CVSS 6.5, published 29 Jul 2026) - [CVE-2026-63237: Three Learning Koollab LMS TOTP 2FA bypass](https://junglewise.ai/threats/cve-2026-63237-three-learning-koollab-lms-totp-2fa-bypass) (medium, CVSS 4.8, published 29 Jul 2026) - [CVE-2026-63236: Three Learning Koollab LMS improper access control in SCORM API](https://junglewise.ai/threats/cve-2026-63236-three-learning-koollab-lms-improper-access-control-in-scorm-api) (low, CVSS 3.7, published 29 Jul 2026) - [CVE-2026-63235: Three Learning Koollab LMS improper access control in login kickout endpoint](https://junglewise.ai/threats/cve-2026-63235-three-learning-koollab-lms-improper-access-control-in-login) (low, CVSS 3.7, published 29 Jul 2026) - [CVE-2026-63234: Three Learning Koollab LMS SQL injection and unsafe deserialization](https://junglewise.ai/threats/cve-2026-63234-three-learning-koollab-lms-sql-injection-and-unsafe) (critical, CVSS 9.9, published 29 Jul 2026) - [CVE-2026-63233: Three Learning Koollab LMS SQL injection and RCE in assessment endpoint](https://junglewise.ai/threats/cve-2026-63233-three-learning-koollab-lms-sql-injection-and-rce-in-assessment) (critical, CVSS 9.9, published 29 Jul 2026) - [CVE-2026-63232: Three Learning Koollab LMS SQL injection and RCE in assessment reinforcement](https://junglewise.ai/threats/cve-2026-63232-three-learning-koollab-lms-sql-injection-and-rce-in-assessment) (critical, CVSS 9.9, published 29 Jul 2026) - [CVE-2026-63231: Three Learning Koollab LMS SQL injection in face-to-face runs update endpoint](https://junglewise.ai/threats/cve-2026-63231-three-learning-koollab-lms-sql-injection-in-face-to-face-runs) (high, CVSS 8.1, published 29 Jul 2026) - [CVE-2026-63230: Three Learning Koollab LMS SQL injection in SCORM report endpoint](https://junglewise.ai/threats/cve-2026-63230-three-learning-koollab-lms-sql-injection-in-scorm-report-endpoint) (critical, CVSS 9.1, published 29 Jul 2026) - [CVE-2026-63229: Three Learning Koollab LMS blind SQL injection in SSO OAuth endpoint](https://junglewise.ai/threats/cve-2026-63229-three-learning-koollab-lms-blind-sql-injection-in-sso-oauth) (critical, CVSS 9.1, published 29 Jul 2026) - [CVE-2026-63228: Three Learning Koollab LMS unrestricted image upload in feedback endpoint](https://junglewise.ai/threats/cve-2026-63228-three-learning-koollab-lms-unrestricted-image-upload-in-feedback) (low, CVSS 2.6, published 29 Jul 2026) - [CVE-2026-63227: Three Learning Koollab LMS unrestricted file upload in SCORM packages](https://junglewise.ai/threats/cve-2026-63227-three-learning-koollab-lms-unrestricted-file-upload-in-scorm) (critical, CVSS 9.9, published 29 Jul 2026) - [CVE-2026-3007: Three Learning Koollab LMS stored XSS in courselet feature](https://junglewise.ai/threats/cve-2026-3007-three-learning-koollab-lms-stored-xss-in-courselet-feature) (medium, CVSS 5.4, published 23 Apr 2026) ## Most severe Three Learning Koollab LMS vulnerabilities - [CVE-2026-63234: Three Learning Koollab LMS SQL injection and unsafe deserialization](https://junglewise.ai/threats/cve-2026-63234-three-learning-koollab-lms-sql-injection-and-unsafe) (critical, CVSS 9.9, published 29 Jul 2026) - [CVE-2026-63233: Three Learning Koollab LMS SQL injection and RCE in assessment endpoint](https://junglewise.ai/threats/cve-2026-63233-three-learning-koollab-lms-sql-injection-and-rce-in-assessment) (critical, CVSS 9.9, published 29 Jul 2026) - [CVE-2026-63232: Three Learning Koollab LMS SQL injection and RCE in assessment reinforcement](https://junglewise.ai/threats/cve-2026-63232-three-learning-koollab-lms-sql-injection-and-rce-in-assessment) (critical, CVSS 9.9, published 29 Jul 2026) - [CVE-2026-63227: Three Learning Koollab LMS unrestricted file upload in SCORM packages](https://junglewise.ai/threats/cve-2026-63227-three-learning-koollab-lms-unrestricted-file-upload-in-scorm) (critical, CVSS 9.9, published 29 Jul 2026) - [CVE-2026-63230: Three Learning Koollab LMS SQL injection in SCORM report endpoint](https://junglewise.ai/threats/cve-2026-63230-three-learning-koollab-lms-sql-injection-in-scorm-report-endpoint) (critical, CVSS 9.1, published 29 Jul 2026) - [CVE-2026-63229: Three Learning Koollab LMS blind SQL injection in SSO OAuth endpoint](https://junglewise.ai/threats/cve-2026-63229-three-learning-koollab-lms-blind-sql-injection-in-sso-oauth) (critical, CVSS 9.1, published 29 Jul 2026) - [CVE-2026-63231: Three Learning Koollab LMS SQL injection in face-to-face runs update endpoint](https://junglewise.ai/threats/cve-2026-63231-three-learning-koollab-lms-sql-injection-in-face-to-face-runs) (high, CVSS 8.1, published 29 Jul 2026) - [CVE-2026-63238: Three Learning Koollab LMS authentication bypass in 2FA endpoint](https://junglewise.ai/threats/cve-2026-63238-three-learning-koollab-lms-authentication-bypass-in-2fa-endpoint) (medium, CVSS 6.5, published 29 Jul 2026) - [CVE-2026-63239: Three Learning Koollab LMS hard-coded AWS IAM credentials](https://junglewise.ai/threats/cve-2026-63239-three-learning-koollab-lms-hard-coded-aws-iam-credentials) (medium, CVSS 5.4, published 29 Jul 2026) - [CVE-2026-3007: Three Learning Koollab LMS stored XSS in courselet feature](https://junglewise.ai/threats/cve-2026-3007-three-learning-koollab-lms-stored-xss-in-courselet-feature) (medium, CVSS 5.4, published 23 Apr 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Three Learning Koollab LMS vulnerabilities", https://junglewise.ai/threats/technologies/koollab-lms, 9 November 2026.