#scorm

payloadforge @payloadforge@infosec.exchange

· 2mo ago

I wrote up CVE-2026-56877, a Skillable SCORM launch issue where the browser supplied userId drove lab allocation while the token was the only trusted value. Skillable's answer was migration, no SCORM path fix, and a private customer advisory. That is why the public record matters for anyone doing vendor due diligence. https://payloadforge.io/beyond-crto-skillable #SCORM #Disclosure #ThirdPartyRisk

Payload Forge

Beyond CRTO: Skillable

TL;DR While working on the RTO course tooling, I found Skillable’s SCORM lab launch path trusted a userId the browser supplies for allocation, while validating only the SCORM token. Changing that value spun up fresh lab instances and, with a colleague’s permission, used up their allocation. This

Simon Dückert @simondueckert@colearn.social

· 3mo ago

#TIL Der #LiquidContent Ansatz spart mir bei vielen meiner wissensintensiven Aufgaben 60-70% Zeit (z.B. Erstellung von E-Learnings im #SCORM Format). Mehr zu dem Ansatz in meinem Impulsvortrag auf der #loscon26: https://youtu.be/yiASGokd9Zw?is=ksE1hl6OCwzV8Ii3

Follow The White Rabbit - Warum KI nur so gut ist wie eure Wissensbasis - Simon Dückert

You've seen all posts