The vulnerability is a stored cross‑site scripting flaw in the courselet feature of Koollab LMS, allowing an attacker to embed malicious JavaScript that is saved and later executed whenever any user accesses the affected courselet. Because the script runs in the context of the victim’s browser, the attacker can steal session cookies, tamper with page content, or perform actions on behalf of the user. This input‑validation weakness, identified as CWE‑79, can lead to confidentiality or integrity compromise for all users who view the vulnerable content.

The issue affects the Koollab Learning Management System produced by Three Learning. All installations that have not applied the latest patch (version 5.4.0) are vulnerable. The patch resolves the input sanitization flaw in the courselet component and should be applied to any environment that hosts or displays courselet content.

With a CVSS score of 5.4 and an EPSS of less than 1 %, the likelihood of active exploitation is low, and the flaw is not listed in the CISA KEV catalog. Nevertheless, because the stored script is executed for every user who views the courselet, the potential impact is high for organizations that rely on this feature. The simplest attack path is for a privileged user to inject malicious payload into a courselet, which then propagates to all other users who access that courselet.