This vulnerability in CoSchool LMS (versions up to 1.4.3) arises from unsafe deserialization of untrusted data, enabling attackers to perform object injection. Such flaws typically allow attackers to execute arbitrary code, escalate privileges, or cause denial of service by manipulating serialized objects processed by the application. The CVSS 3.1 score of 9.8 reflects network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to full system compromise, including unauthorized code execution, data breach, and service disruption. The vulnerability affects all installations of CoSchool LMS up to version 1.4.3. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting features that process serialized data if possible. Monitor vendor channels for updates and apply patches promptly once available.