EUVD-2026-67013
GHSA-89q2-6fq2-wxfg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated endpoint with no special conditions; high confidentiality from data exfiltration, low integrity reflecting potential DB writes subject to app-user grants, no availability impact.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter id_ambito. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via PDOException. This confirms that user input is being incorporated directly into SQL statements without proper sanitization or the use of prepared statements.
AnalysisAI
SQL injection in Toools Isquad's '/ws/apiprensa/getVideo' endpoint exposes the MariaDB backend to unauthenticated remote attackers who can manipulate the 'id_ambito' GET parameter. Direct string concatenation of user input into SQL statements - without parameterized queries - causes query structure breakage and leaks raw PDOException error messages, actively confirming exploitability and revealing database schema details. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The '/ws/apiprensa/getVideo' API endpoint must be network-accessible and the 'apiprensa' module must be active within the Toools Isquad deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N) scores 8.8 and signals a network-accessible, low-complexity, unauthenticated flaw with high confidentiality impact and limited integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends an HTTP GET request to '/ws/apiprensa/getVideo?id_ambito=1%27' against a publicly exposed Toools Isquad instance. The injected single quote breaks the MariaDB query structure, and the application returns a raw PDOException error message revealing the query template and database identifiers. … |
| Remediation | A vendor-released patch is confirmed available per the INCIBE advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Tools Isquad deployments in your environment and determine which are internet-facing. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in toools Isquad lets remote unauthenticated attackers manipulate database queries via the id_seccion para
SQL injection in toools Isquad exposes the '/ws/apiprensa/getVideoNextPrev' endpoint to unauthenticated database manipul
SQL injection in Toools iSquad exposes the unauthenticated '/ws/apitribuna/setVisita' web-service endpoint, where the id
SQL injection in Toools iSquad's '/ws/apiprensa/getVideoSubcanal' API endpoint lets remote unauthenticated attackers man
Error-based SQL injection in Toools iSquad's `/ws/apitribuna/ultimosVideos` API endpoint enables unauthenticated remote
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today