CVE-2026-3007
Stored XSS in Koollab LMS Courselet Enables Arbitrary JavaScript Execution
Publication date: 2026-04-23
Last updated on: 2026-05-05
Assigner: CSA
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| three_learning | koollab_learning_management_system | 5.3.2 |
| three_learning | koollab_learning_management_system | 5.4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stored cross-site scripting (XSS) issue found in Koollab Learning Management System (LMS) version 5.3.2. It allows an attacker to inject and execute arbitrary JavaScript code on any user account that has access to the LMS's courselet feature.
How can this vulnerability impact me? :
Exploitation of this vulnerability could allow an attacker to execute malicious JavaScript code within the context of a user's session. This can lead to unauthorized actions such as stealing user credentials, hijacking user sessions, or performing actions on behalf of the user without their consent.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the stored cross-site scripting (XSS) vulnerability in Koollab Learning Management System (LMS), users and administrators are strongly advised to upgrade to Koollab LMS version 5.4.0 immediately.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The stored cross-site scripting (XSS) vulnerability in Koollab LMS could allow attackers to execute arbitrary JavaScript on user accounts, potentially leading to unauthorized access or data exposure.
Such unauthorized access or data exposure could impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding user data and preventing unauthorized access.
However, the provided information does not explicitly detail the direct effects on compliance with these standards.