EUVD-2026-67011
GHSA-cc7j-wc52-pjhx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable endpoint with a directly injectable parameter gives AV:N/AC:L/PR:N/UI:N; SQLi yields high read and plausible write impact (C:H/I:H) with no availability effect.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and cause database errors, exposing the internal logic of the queries. The complexity of the query increases the potential impact, as it could allow for broader manipulation of the content retrieval logic.
AnalysisAI
SQL injection in toools Isquad lets remote unauthenticated attackers manipulate database queries via the id_seccion parameter of the '/ws/apiprensa/getVideoUltimasSeccion' web-service endpoint. The parameter is concatenated into a complex query using grouping and sorting, letting an attacker break the query structure, trigger database errors that leak internal query logic, and potentially extract or alter content-retrieval data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerable endpoint '/ws/apiprensa/getVideoUltimasSeccion' must be network-reachable by the attacker, and the request must supply an attacker-controlled id_seccion parameter, which is injected into a SQL query performing grouping and sorting. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely consistent and point to a genuine, easily reachable vulnerability rather than an inflated score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker on the network sends a crafted HTTP request to '/ws/apiprensa/getVideoUltimasSeccion' with a malicious id_seccion value containing SQL syntax that closes the expression and appends a UNION or boolean condition. The injected syntax disrupts the grouping/sorting query, producing database errors that reveal query structure and enabling iterative extraction or manipulation of content data. … |
| Remediation | Patch available per vendor advisory: apply the fix referenced in the INCIBE notice at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad - an exact patched version number is not included in the provided data, so obtain it directly from toools or the INCIBE advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of toools Isquad in your environment and obtain the vendor patch. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in toools Isquad exposes the '/ws/apiprensa/getVideoNextPrev' endpoint to unauthenticated database manipul
SQL injection in Toools iSquad exposes the unauthenticated '/ws/apitribuna/setVisita' web-service endpoint, where the id
SQL injection in Toools iSquad's '/ws/apiprensa/getVideoSubcanal' API endpoint lets remote unauthenticated attackers man
SQL injection in Toools Isquad's '/ws/apiprensa/getVideo' endpoint exposes the MariaDB backend to unauthenticated remote
Error-based SQL injection in Toools iSquad's `/ws/apitribuna/ultimosVideos` API endpoint enables unauthenticated remote
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today