Search
Find a vulnerability
Search criteria
12 vulnerabilities found for iSquad by TOOOLS
CVE-2026-81677 (GCVE-0-2026-81677)
Vulnerability from nvd – Published: 2026-08-27 12:09 – Updated: 2026-08-27 15:35
VLAI
EPSS
VEX
Title
Multiple Vulnerabilities in TOOOLS' iSquad
Summary
The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via PDOException. This confirms that user input is being incorporated directly into SQL statements without proper sanitization or the use of prepared statements.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 15:35 UTC
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/avis… | patch |
Date Public
2026-08-27 11:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81677",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T15:35:34.698007Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:35:43.319Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iSquad",
"vendor": "TOOOLS",
"versions": [
{
"lessThan": "22/07/2026",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "DylanCV"
}
],
"datePublic": "2026-08-27T11:47:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The \u2018/ws/apiprensa/getVideo\u2019 endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via PDOException. This confirms that user input is being incorporated directly into SQL statements without proper sanitization or the use of prepared statements."
}
],
"value": "The \u2018/ws/apiprensa/getVideo\u2019 endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via PDOException. This confirms that user input is being incorporated directly into SQL statements without proper sanitization or the use of prepared statements."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:09:27.729Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\u003cbr\u003e\n\u003cbr\u003eThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\u003cbr\u003eAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\u003cbr\u003e\n\u003cbr\u003eiSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\n\n\nThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\nAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\n\n\niSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple Vulnerabilities in TOOOLS\u0027 iSquad",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-81677",
"datePublished": "2026-08-27T12:09:27.729Z",
"dateReserved": "2026-08-27T10:59:55.957Z",
"dateUpdated": "2026-08-27T15:35:43.319Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81676 (GCVE-0-2026-81676)
Vulnerability from nvd – Published: 2026-08-27 12:08 – Updated: 2026-08-27 15:38
VLAI
EPSS
VEX
Title
Multiple Vulnerabilities in TOOOLS' iSquad
Summary
A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and potentially manipulate backend queries. The issue results in an error-based SQL injection and exposes internal database error messages and stack traces, revealing implementation details of the backend system.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 15:38 UTC
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/avis… | patch |
Date Public
2026-08-27 11:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81676",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T15:38:31.611350Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:38:39.538Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iSquad",
"vendor": "TOOOLS",
"versions": [
{
"lessThan": "22/07/2026",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "DylanCV"
}
],
"datePublic": "2026-08-27T11:47:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in the endpoint \u2018/ws/apitribuna/ultimosVideos\u2019 where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and potentially manipulate backend queries. The issue results in an error-based SQL injection and exposes internal database error messages and stack traces, revealing implementation details of the backend system."
}
],
"value": "A vulnerability in the endpoint \u2018/ws/apitribuna/ultimosVideos\u2019 where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and potentially manipulate backend queries. The issue results in an error-based SQL injection and exposes internal database error messages and stack traces, revealing implementation details of the backend system."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:08:54.658Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\u003cbr\u003e\n\u003cbr\u003eThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\u003cbr\u003eAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\u003cbr\u003e\n\u003cbr\u003eiSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\n\n\nThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\nAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\n\n\niSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple Vulnerabilities in TOOOLS\u0027 iSquad",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-81676",
"datePublished": "2026-08-27T12:08:54.658Z",
"dateReserved": "2026-08-27T10:59:54.611Z",
"dateUpdated": "2026-08-27T15:38:39.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81675 (GCVE-0-2026-81675)
Vulnerability from nvd – Published: 2026-08-27 12:07 – Updated: 2026-08-27 15:39
VLAI
EPSS
VEX
Title
Multiple Vulnerabilities in TOOOLS' iSquad
Summary
The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and cause database errors, exposing the internal logic of the queries. The complexity of the query increases the potential impact, as it could allow for broader manipulation of the content retrieval logic.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 15:39 UTC
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/avis… | patch |
Date Public
2026-08-27 11:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81675",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T15:39:50.312381Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:39:59.092Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iSquad",
"vendor": "TOOOLS",
"versions": [
{
"lessThan": "22/07/2026",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "DylanCV"
}
],
"datePublic": "2026-08-27T11:47:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The endpoint \u2018/ws/apiprensa/getVideoUltimasSeccion\u2019 contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and cause database errors, exposing the internal logic of the queries. The complexity of the query increases the potential impact, as it could allow for broader manipulation of the content retrieval logic."
}
],
"value": "The endpoint \u2018/ws/apiprensa/getVideoUltimasSeccion\u2019 contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and cause database errors, exposing the internal logic of the queries. The complexity of the query increases the potential impact, as it could allow for broader manipulation of the content retrieval logic."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:07:48.303Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\u003cbr\u003e\n\u003cbr\u003eThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\u003cbr\u003eAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\u003cbr\u003e\n\u003cbr\u003eiSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\n\n\nThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\nAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\n\n\niSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple Vulnerabilities in TOOOLS\u0027 iSquad",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-81675",
"datePublished": "2026-08-27T12:07:48.303Z",
"dateReserved": "2026-08-27T10:59:53.398Z",
"dateUpdated": "2026-08-27T15:39:59.092Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81674 (GCVE-0-2026-81674)
Vulnerability from nvd – Published: 2026-08-27 12:06 – Updated: 2026-08-27 15:41
VLAI
EPSS
VEX
Title
Multiple Vulnerabilities in TOOOLS' iSquad
Summary
The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database error messages and exposes the internal structure of the queries, which could facilitate further exploitation.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 15:41 UTC
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/avis… | patch |
Date Public
2026-08-27 11:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81674",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T15:41:24.409190Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:41:31.366Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iSquad",
"vendor": "TOOOLS",
"versions": [
{
"lessThan": "22/07/2026",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "DylanCV"
}
],
"datePublic": "2026-08-27T11:47:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The endpoint \u2018/ws/apiprensa/getVideoNextPrev\u2019 is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query\u0027s execution. The vulnerability results in detailed database error messages and exposes the internal structure of the queries, which could facilitate further exploitation."
}
],
"value": "The endpoint \u2018/ws/apiprensa/getVideoNextPrev\u2019 is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query\u0027s execution. The vulnerability results in detailed database error messages and exposes the internal structure of the queries, which could facilitate further exploitation."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:06:35.814Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\u003cbr\u003e\n\u003cbr\u003eThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\u003cbr\u003eAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\u003cbr\u003e\n\u003cbr\u003eiSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\n\n\nThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\nAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\n\n\niSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple Vulnerabilities in TOOOLS\u0027 iSquad",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-81674",
"datePublished": "2026-08-27T12:06:35.814Z",
"dateReserved": "2026-08-27T10:59:52.341Z",
"dateUpdated": "2026-08-27T15:41:31.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81673 (GCVE-0-2026-81673)
Vulnerability from nvd – Published: 2026-08-27 12:05 – Updated: 2026-08-27 15:42
VLAI
EPSS
VEX
Title
Multiple Vulnerabilities in TOOOLS' iSquad
Summary
The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of queries, causing database errors and potentially manipulating visit tracking records. Given the nature of the endpoint, this could also affect the integrity of analytics and the accuracy of records.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 15:42 UTC
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/avis… | patch |
Date Public
2026-08-27 11:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81673",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T15:42:07.014758Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:42:20.927Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iSquad",
"vendor": "TOOOLS",
"versions": [
{
"lessThan": "22/07/2026",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "DylanCV"
}
],
"datePublic": "2026-08-27T11:47:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The \u2018/ws/apitribuna/setVisita\u2019 endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of queries, causing database errors and potentially manipulating visit tracking records. Given the nature of the endpoint, this could also affect the integrity of analytics and the accuracy of records."
}
],
"value": "The \u2018/ws/apitribuna/setVisita\u2019 endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of queries, causing database errors and potentially manipulating visit tracking records. Given the nature of the endpoint, this could also affect the integrity of analytics and the accuracy of records."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:05:44.611Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\u003cbr\u003e\n\u003cbr\u003eThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\u003cbr\u003eAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\u003cbr\u003e\n\u003cbr\u003eiSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\n\n\nThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\nAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\n\n\niSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple Vulnerabilities in TOOOLS\u0027 iSquad",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-81673",
"datePublished": "2026-08-27T12:05:44.611Z",
"dateReserved": "2026-08-27T10:59:51.232Z",
"dateUpdated": "2026-08-27T15:42:20.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81672 (GCVE-0-2026-81672)
Vulnerability from nvd – Published: 2026-08-27 11:53 – Updated: 2026-08-27 15:04
VLAI
EPSS
VEX
Title
Multiple Vulnerabilities in TOOOLS' iSquad
Summary
SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes internal file paths and complete stack traces through the Slim framework’s error handler, which increases the severity due to the combination of information disclosure and SQL injection.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:02 UTC
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/avis… | patch |
Date Public
2026-08-27 11:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81672",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:02:58.366613Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:04:10.313Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iSquad",
"vendor": "TOOOLS",
"versions": [
{
"lessThan": "22/07/2026",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "DylanCV"
}
],
"datePublic": "2026-08-27T11:47:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "SQL injection vulnerability in the \u2018/ws/apiprensa/getVideoSubcanal\u2019 endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes internal file paths and complete stack traces through the Slim framework\u2019s error handler, which increases the severity due to the combination of information disclosure and SQL injection."
}
],
"value": "SQL injection vulnerability in the \u2018/ws/apiprensa/getVideoSubcanal\u2019 endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes internal file paths and complete stack traces through the Slim framework\u2019s error handler, which increases the severity due to the combination of information disclosure and SQL injection."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T11:53:59.348Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\u003cbr\u003e\n\u003cbr\u003eThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\u003cbr\u003eAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\u003cbr\u003e\n\u003cbr\u003eiSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\n\n\nThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\nAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\n\n\niSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple Vulnerabilities in TOOOLS\u0027 iSquad",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-81672",
"datePublished": "2026-08-27T11:53:35.259Z",
"dateReserved": "2026-08-27T10:59:50.036Z",
"dateUpdated": "2026-08-27T15:04:10.313Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81677 (GCVE-0-2026-81677)
Vulnerability from cvelistv5 – Published: 2026-08-27 12:09 – Updated: 2026-08-27 15:35
VLAI
EPSS
VEX
Title
Multiple Vulnerabilities in TOOOLS' iSquad
Summary
The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via PDOException. This confirms that user input is being incorporated directly into SQL statements without proper sanitization or the use of prepared statements.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 15:35 UTC
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/avis… | patch |
Date Public
2026-08-27 11:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81677",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T15:35:34.698007Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:35:43.319Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iSquad",
"vendor": "TOOOLS",
"versions": [
{
"lessThan": "22/07/2026",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "DylanCV"
}
],
"datePublic": "2026-08-27T11:47:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The \u2018/ws/apiprensa/getVideo\u2019 endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via PDOException. This confirms that user input is being incorporated directly into SQL statements without proper sanitization or the use of prepared statements."
}
],
"value": "The \u2018/ws/apiprensa/getVideo\u2019 endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via PDOException. This confirms that user input is being incorporated directly into SQL statements without proper sanitization or the use of prepared statements."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:09:27.729Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\u003cbr\u003e\n\u003cbr\u003eThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\u003cbr\u003eAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\u003cbr\u003e\n\u003cbr\u003eiSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\n\n\nThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\nAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\n\n\niSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple Vulnerabilities in TOOOLS\u0027 iSquad",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-81677",
"datePublished": "2026-08-27T12:09:27.729Z",
"dateReserved": "2026-08-27T10:59:55.957Z",
"dateUpdated": "2026-08-27T15:35:43.319Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81676 (GCVE-0-2026-81676)
Vulnerability from cvelistv5 – Published: 2026-08-27 12:08 – Updated: 2026-08-27 15:38
VLAI
EPSS
VEX
Title
Multiple Vulnerabilities in TOOOLS' iSquad
Summary
A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and potentially manipulate backend queries. The issue results in an error-based SQL injection and exposes internal database error messages and stack traces, revealing implementation details of the backend system.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 15:38 UTC
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/avis… | patch |
Date Public
2026-08-27 11:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81676",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T15:38:31.611350Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:38:39.538Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iSquad",
"vendor": "TOOOLS",
"versions": [
{
"lessThan": "22/07/2026",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "DylanCV"
}
],
"datePublic": "2026-08-27T11:47:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in the endpoint \u2018/ws/apitribuna/ultimosVideos\u2019 where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and potentially manipulate backend queries. The issue results in an error-based SQL injection and exposes internal database error messages and stack traces, revealing implementation details of the backend system."
}
],
"value": "A vulnerability in the endpoint \u2018/ws/apitribuna/ultimosVideos\u2019 where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and potentially manipulate backend queries. The issue results in an error-based SQL injection and exposes internal database error messages and stack traces, revealing implementation details of the backend system."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:08:54.658Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\u003cbr\u003e\n\u003cbr\u003eThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\u003cbr\u003eAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\u003cbr\u003e\n\u003cbr\u003eiSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\n\n\nThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\nAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\n\n\niSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple Vulnerabilities in TOOOLS\u0027 iSquad",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-81676",
"datePublished": "2026-08-27T12:08:54.658Z",
"dateReserved": "2026-08-27T10:59:54.611Z",
"dateUpdated": "2026-08-27T15:38:39.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81675 (GCVE-0-2026-81675)
Vulnerability from cvelistv5 – Published: 2026-08-27 12:07 – Updated: 2026-08-27 15:39
VLAI
EPSS
VEX
Title
Multiple Vulnerabilities in TOOOLS' iSquad
Summary
The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and cause database errors, exposing the internal logic of the queries. The complexity of the query increases the potential impact, as it could allow for broader manipulation of the content retrieval logic.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 15:39 UTC
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/avis… | patch |
Date Public
2026-08-27 11:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81675",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T15:39:50.312381Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:39:59.092Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iSquad",
"vendor": "TOOOLS",
"versions": [
{
"lessThan": "22/07/2026",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "DylanCV"
}
],
"datePublic": "2026-08-27T11:47:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The endpoint \u2018/ws/apiprensa/getVideoUltimasSeccion\u2019 contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and cause database errors, exposing the internal logic of the queries. The complexity of the query increases the potential impact, as it could allow for broader manipulation of the content retrieval logic."
}
],
"value": "The endpoint \u2018/ws/apiprensa/getVideoUltimasSeccion\u2019 contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and cause database errors, exposing the internal logic of the queries. The complexity of the query increases the potential impact, as it could allow for broader manipulation of the content retrieval logic."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:07:48.303Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\u003cbr\u003e\n\u003cbr\u003eThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\u003cbr\u003eAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\u003cbr\u003e\n\u003cbr\u003eiSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\n\n\nThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\nAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\n\n\niSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple Vulnerabilities in TOOOLS\u0027 iSquad",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-81675",
"datePublished": "2026-08-27T12:07:48.303Z",
"dateReserved": "2026-08-27T10:59:53.398Z",
"dateUpdated": "2026-08-27T15:39:59.092Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81674 (GCVE-0-2026-81674)
Vulnerability from cvelistv5 – Published: 2026-08-27 12:06 – Updated: 2026-08-27 15:41
VLAI
EPSS
VEX
Title
Multiple Vulnerabilities in TOOOLS' iSquad
Summary
The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database error messages and exposes the internal structure of the queries, which could facilitate further exploitation.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 15:41 UTC
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/avis… | patch |
Date Public
2026-08-27 11:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81674",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T15:41:24.409190Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:41:31.366Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iSquad",
"vendor": "TOOOLS",
"versions": [
{
"lessThan": "22/07/2026",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "DylanCV"
}
],
"datePublic": "2026-08-27T11:47:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The endpoint \u2018/ws/apiprensa/getVideoNextPrev\u2019 is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query\u0027s execution. The vulnerability results in detailed database error messages and exposes the internal structure of the queries, which could facilitate further exploitation."
}
],
"value": "The endpoint \u2018/ws/apiprensa/getVideoNextPrev\u2019 is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query\u0027s execution. The vulnerability results in detailed database error messages and exposes the internal structure of the queries, which could facilitate further exploitation."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:06:35.814Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\u003cbr\u003e\n\u003cbr\u003eThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\u003cbr\u003eAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\u003cbr\u003e\n\u003cbr\u003eiSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\n\n\nThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\nAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\n\n\niSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple Vulnerabilities in TOOOLS\u0027 iSquad",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-81674",
"datePublished": "2026-08-27T12:06:35.814Z",
"dateReserved": "2026-08-27T10:59:52.341Z",
"dateUpdated": "2026-08-27T15:41:31.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81673 (GCVE-0-2026-81673)
Vulnerability from cvelistv5 – Published: 2026-08-27 12:05 – Updated: 2026-08-27 15:42
VLAI
EPSS
VEX
Title
Multiple Vulnerabilities in TOOOLS' iSquad
Summary
The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of queries, causing database errors and potentially manipulating visit tracking records. Given the nature of the endpoint, this could also affect the integrity of analytics and the accuracy of records.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 15:42 UTC
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/avis… | patch |
Date Public
2026-08-27 11:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81673",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T15:42:07.014758Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:42:20.927Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iSquad",
"vendor": "TOOOLS",
"versions": [
{
"lessThan": "22/07/2026",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "DylanCV"
}
],
"datePublic": "2026-08-27T11:47:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The \u2018/ws/apitribuna/setVisita\u2019 endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of queries, causing database errors and potentially manipulating visit tracking records. Given the nature of the endpoint, this could also affect the integrity of analytics and the accuracy of records."
}
],
"value": "The \u2018/ws/apitribuna/setVisita\u2019 endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of queries, causing database errors and potentially manipulating visit tracking records. Given the nature of the endpoint, this could also affect the integrity of analytics and the accuracy of records."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:05:44.611Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\u003cbr\u003e\n\u003cbr\u003eThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\u003cbr\u003eAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\u003cbr\u003e\n\u003cbr\u003eiSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\n\n\nThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\nAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\n\n\niSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple Vulnerabilities in TOOOLS\u0027 iSquad",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-81673",
"datePublished": "2026-08-27T12:05:44.611Z",
"dateReserved": "2026-08-27T10:59:51.232Z",
"dateUpdated": "2026-08-27T15:42:20.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81672 (GCVE-0-2026-81672)
Vulnerability from cvelistv5 – Published: 2026-08-27 11:53 – Updated: 2026-08-27 15:04
VLAI
EPSS
VEX
Title
Multiple Vulnerabilities in TOOOLS' iSquad
Summary
SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes internal file paths and complete stack traces through the Slim framework’s error handler, which increases the severity due to the combination of information disclosure and SQL injection.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:02 UTC
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/avis… | patch |
Date Public
2026-08-27 11:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81672",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:02:58.366613Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:04:10.313Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iSquad",
"vendor": "TOOOLS",
"versions": [
{
"lessThan": "22/07/2026",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "DylanCV"
}
],
"datePublic": "2026-08-27T11:47:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "SQL injection vulnerability in the \u2018/ws/apiprensa/getVideoSubcanal\u2019 endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes internal file paths and complete stack traces through the Slim framework\u2019s error handler, which increases the severity due to the combination of information disclosure and SQL injection."
}
],
"value": "SQL injection vulnerability in the \u2018/ws/apiprensa/getVideoSubcanal\u2019 endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes internal file paths and complete stack traces through the Slim framework\u2019s error handler, which increases the severity due to the combination of information disclosure and SQL injection."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T11:53:59.348Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\u003cbr\u003e\n\u003cbr\u003eThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\u003cbr\u003eAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\u003cbr\u003e\n\u003cbr\u003eiSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"value": "The vulnerabilities have been resolved by the TOOOLS team.\n\n\n\nThe reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.\n\nAs an additional and proactive measure, input validation and sanitization in the application\u2019s comments module have also been strengthened.\n\n\n\niSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple Vulnerabilities in TOOOLS\u0027 iSquad",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-81672",
"datePublished": "2026-08-27T11:53:35.259Z",
"dateReserved": "2026-08-27T10:59:50.036Z",
"dateUpdated": "2026-08-27T15:04:10.313Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}