CVE-2026-3007 - Vulnerability Details - OpenCVE

Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS’ courselet feature.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00027.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Three Learning

Koollab Learning Management System

unaffected

Version	Status	Constraints
`5.3.2.`	affected	—

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

Users and administrators of the affected product version are advised to update to the latest version 5.4.0 immediately.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-042/

History

Thu, 23 Apr 2026 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 23 Apr 2026 04:00:00 +0000

Type	Values Removed	Values Added
Description		Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS’ courselet feature.
Title		Stored Cross-Site Scripting (XSS) Vulnerability
References		https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-042/
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: CSA

Published: 2026-04-23T02:54:25.444Z

Updated: 2026-04-23T16:23:11.970Z

Reserved: 2026-02-23T05:15:43.206Z

Link: CVE-2026-3007

Vulnrichment

Updated: 2026-04-23T14:41:27.649Z

NVD

Status : Received

Published: 2026-04-23T04:16:07.980

Modified: 2026-04-23T04:16:07.980

Link: CVE-2026-3007

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3007", "assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4", "state": "PUBLISHED", "assignerShortName": "CSA", "dateReserved": "2026-02-23T05:15:43.206Z", "datePublished": "2026-04-23T02:54:25.444Z", "dateUpdated": "2026-04-23T16:23:11.970Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4", "shortName": "CSA", "dateUpdated": "2026-04-23T02:54:25.444Z"}, "title": "Stored Cross-Site Scripting (XSS) Vulnerability", "datePublic": "2026-04-23T02:50:00.000Z", "affected": [{"vendor": "Three Learning", "product": "Koollab Learning Management System", "versions": [{"status": "affected", "version": "5.3.2."}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS\u2019 courselet feature.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS\u2019 courselet feature.</p>"}]}], "references": [{"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-042/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}}], "solutions": [{"lang": "en", "value": "Users and administrators of the affected product version are advised to update to the latest version 5.4.0 immediately.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Users and administrators of the affected product version are advised to update to the latest version 5.4.0 immediately."}]}], "credits": [{"lang": "en", "value": "Justin Ng", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-23T14:41:20.084000Z", "id": "CVE-2026-3007", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T16:23:11.970Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3007", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-23T14:41:20.084000Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T14:41:27.649Z"}}], "cna": {"title": "Stored Cross-Site Scripting (XSS) Vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Justin Ng"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Three Learning", "product": "Koollab Learning Management System", "versions": [{"status": "affected", "version": "5.3.2."}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Users and administrators of the affected product version are advised to update to the latest version 5.4.0 immediately.", "supportingMedia": [{"type": "text/html", "value": "Users and administrators of the affected product version are advised to update to the latest version 5.4.0 immediately.", "base64": false}]}], "datePublic": "2026-04-23T02:50:00.000Z", "references": [{"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-042/"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS\u2019 courselet feature.", "supportingMedia": [{"type": "text/html", "value": "<p>Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS\u2019 courselet feature.</p>", "base64": false}]}], "providerMetadata": {"orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4", "shortName": "CSA", "dateUpdated": "2026-04-23T02:54:25.444Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3007", "state": "PUBLISHED", "dateUpdated": "2026-04-23T16:23:11.970Z", "dateReserved": "2026-02-23T05:15:43.206Z", "assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4", "datePublished": "2026-04-23T02:54:25.444Z", "assignerShortName": "CSA"}, "dataVersion": "5.2"}