A pre‑authentication error‑based SQL injection issue in Koollab LMS allows an unauthenticated attacker to read sensitive database contents through the SCORM report endpoint, including personally identifiable information, credentials, and valid JWT tokens that could enable account takeover. The weakness is a classic SQL injection flaw (CWE‑89) that compromises confidentiality and permits credential theft.

The vulnerability affects the Koollab LMS product from Three Learning. No specific version numbers are supplied in the advisory, so all releases of Koollab LMS remain potentially impacted until an official patch note is released.

The CVSS score of 9.1 classifies the issue as Critical severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a simple HTTP request to the SCORM report endpoint without any authentication, inferred from the description of unauthenticated access. An attacker can manipulate query parameters to trigger an error‑based SQL injection and retrieve data from the database, which can be used for direct credential theft or further escalation.