CVE-2026-3007 - Vulnerability Details - OpenCVE

Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS’ courselet feature.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Three Learning	Koollab Learning Management System

No data.

No data.

References

Link	Providers
https://www.spirityenterprise.com/pentest
https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-042/

History

Tue, 28 Apr 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-79

Tue, 28 Apr 2026 09:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Three Learning Three Learning koollab Learning Management System
Vendors & Products		Three Learning Three Learning koollab Learning Management System

Thu, 23 Apr 2026 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 23 Apr 2026 04:00:00 +0000

Type	Values Removed	Values Added
Description		Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS’ courselet feature.
Title		Stored Cross-Site Scripting (XSS) Vulnerability
References		https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-042/
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: CSA

Published: 2026-04-23T02:54:25.444Z

Updated: 2026-04-23T16:23:11.970Z

Reserved: 2026-02-23T05:15:43.206Z

Link: CVE-2026-3007

Vulnrichment

Updated: 2026-04-23T14:41:27.649Z

NVD

Status : Awaiting Analysis

Published: 2026-04-23T04:16:07.980

Modified: 2026-04-24T14:50:56.203

Link: CVE-2026-3007

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3007", "assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4", "state": "PUBLISHED", "assignerShortName": "CSA", "dateReserved": "2026-02-23T05:15:43.206Z", "datePublished": "2026-04-23T02:54:25.444Z", "dateUpdated": "2026-04-23T16:23:11.970Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4", "shortName": "CSA", "dateUpdated": "2026-04-23T02:54:25.444Z"}, "title": "Stored Cross-Site Scripting (XSS) Vulnerability", "datePublic": "2026-04-23T02:50:00.000Z", "affected": [{"vendor": "Three Learning", "product": "Koollab Learning Management System", "versions": [{"status": "affected", "version": "5.3.2."}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS\u2019 courselet feature.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS\u2019 courselet feature.</p>"}]}], "references": [{"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-042/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}}], "solutions": [{"lang": "en", "value": "Users and administrators of the affected product version are advised to update to the latest version 5.4.0 immediately.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Users and administrators of the affected product version are advised to update to the latest version 5.4.0 immediately."}]}], "credits": [{"lang": "en", "value": "Justin Ng", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-23T14:41:20.084000Z", "id": "CVE-2026-3007", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T16:23:11.970Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3007", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-23T14:41:20.084000Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T14:41:27.649Z"}}], "cna": {"title": "Stored Cross-Site Scripting (XSS) Vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Justin Ng"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Three Learning", "product": "Koollab Learning Management System", "versions": [{"status": "affected", "version": "5.3.2."}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Users and administrators of the affected product version are advised to update to the latest version 5.4.0 immediately.", "supportingMedia": [{"type": "text/html", "value": "Users and administrators of the affected product version are advised to update to the latest version 5.4.0 immediately.", "base64": false}]}], "datePublic": "2026-04-23T02:50:00.000Z", "references": [{"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-042/"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS\u2019 courselet feature.", "supportingMedia": [{"type": "text/html", "value": "<p>Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS\u2019 courselet feature.</p>", "base64": false}]}], "providerMetadata": {"orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4", "shortName": "CSA", "dateUpdated": "2026-04-23T02:54:25.444Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3007", "state": "PUBLISHED", "dateUpdated": "2026-04-23T16:23:11.970Z", "dateReserved": "2026-02-23T05:15:43.206Z", "assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4", "datePublished": "2026-04-23T02:54:25.444Z", "assignerShortName": "CSA"}, "dataVersion": "5.2"}