CVE-2026-63242

Published Jul 29, 2026

Last updated 24 days ago

CVSS medium 4.3
Business logic

Overview

Description
A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records.
Source
5f57b9bf-260d-4433-bf07-b6a79e9bb7d4
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
4.3
Impact score
1.4
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Severity
MEDIUM

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-639

Social media

Hype score
Not currently trending

Related CVEs

  1. TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Connections approval flow via Unattended Access and establish a remote connection to an affected macOS host.•CVE-2026-12703
  2. Check Point SmartConsole Improper Authentication Vulnerability•CVE-2026-16232
  3. Oracle E-Business Suite Improper Privilege Management Vulnerability•CVE-2026-46817
  4. This vulnerability stems from a business logic flaw.Attackers can exploit legitimate application functions in unintended and abnormal ways, deviating from the designer's expectations, to carry out malicious attacks.•CVE-2026-44410
  5. A security vulnerability has been detected in Sanluan PublicCMS 5.202506.d. Impacted is the function TradeOrderController.pay/TradePaymentController.pay/AccountGatewayComponent.pay of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeOrderController.java of the component Trade Payment Flow. The manipulation leads to business logic errors. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.•CVE-2026-8738

References

Sources include official advisories and independent security research.