Skip to main content

Toools iSquad CVE-2026-81676

| EUVDEUVD-2026-67012 HIGH
SQL Injection (CWE-89)
2026-08-27 INCIBE GHSA-vwjv-vcjm-rxvp
SQLi Isquad
8.8
CVSS 4.0 · Vendor: INCIBE
Share

Severity by source

Vendor (INCIBE) PRIMARY
8.8 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.2 HIGH

Network-reachable endpoint with no authentication (PR:N); high confidentiality impact from database read; limited integrity impact from query manipulation; no availability impact described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (INCIBE).

CVSS VectorVendor: INCIBE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 27, 2026 - 13:37 vuln.today
CVE Published
Aug 27, 2026 - 12:08 cve.org
HIGH 8.8

DescriptionCVE.org

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limit_videos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and potentially manipulate backend queries. The issue results in an error-based SQL injection and exposes internal database error messages and stack traces, revealing implementation details of the backend system.

AnalysisAI

Error-based SQL injection in Toools iSquad's /ws/apitribuna/ultimosVideos API endpoint enables unauthenticated remote attackers to manipulate MariaDB queries and extract sensitive database contents. The limit_videos parameter is concatenated unsanitized into the SQL query, a textbook CWE-89 flaw. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send crafted HTTP request to /ws/apitribuna/ultimosVideos
Delivery
Inject SQL syntax into limit_videos parameter
Exploit
MariaDB executes malformed query
Execution
Application returns verbose error with extracted data
Persist
Enumerate database schema from error messages
Impact
Exfiltrate sensitive database contents
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special configuration is required beyond the `/ws/apitribuna/ultimosVideos` endpoint being network-accessible, as the CVSS 4.0 vector specifies AV:N/AC:L/AT:N/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N) scores 8.8 and reflects a highly accessible attack surface: no authentication, no user interaction, low attack complexity, and network-reachable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker sends an HTTP GET or POST request to `/ws/apitribuna/ultimosVideos` with a crafted `limit_videos` value such as `1 AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT table_name FROM information_schema.tables LIMIT 1)))`. The MariaDB error handler returns a verbose error message containing the extracted data, allowing the attacker to enumerate the full database schema and subsequently extract credentials, user data, or other sensitive records. …
Remediation Apply the vendor-released patch referenced in the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad - the advisory is flagged as a patch source, but no specific fixed version number was included in the available intelligence; consult the advisory directly for the exact patched release. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all systems running Toools iSquad, assess which databases store sensitive data, and implement temporary network-level restrictions on the /ws/apitribuna/ultimosVideos endpoint if operationally feasible. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Isquad

View all
CVE-2026-81675 CRITICAL
9.3 Aug 27

SQL injection in toools Isquad lets remote unauthenticated attackers manipulate database queries via the id_seccion para
CVE-2026-81674 CRITICAL
9.3 Aug 27

SQL injection in toools Isquad exposes the '/ws/apiprensa/getVideoNextPrev' endpoint to unauthenticated database manipul
CVE-2026-81673 CRITICAL
9.3 Aug 27

SQL injection in Toools iSquad exposes the unauthenticated '/ws/apitribuna/setVisita' web-service endpoint, where the id
CVE-2026-81672 CRITICAL
9.3 Aug 27

SQL injection in Toools iSquad's '/ws/apiprensa/getVideoSubcanal' API endpoint lets remote unauthenticated attackers man
CVE-2026-81677 HIGH
8.8 Aug 27

SQL injection in Toools Isquad's '/ws/apiprensa/getVideo' endpoint exposes the MariaDB backend to unauthenticated remote

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

CVE-2026-81676 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy