CVE-2026-3007

Description

Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS’ courselet feature.

PUBLISHED Reserved 2026-02-23 | Published 2026-04-23 | Updated 2026-04-23 | Assigner CSA

Product status

Credits

Justin Ng finder

References

www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-042/

cve.org (CVE-2026-3007)

nvd.nist.gov (CVE-2026-3007)

Download JSON