CVE-2026-81676: Multiple Vulnerabilities in TOOOLS' iSquad
A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and potentially manipulate backend queries. The issue results in an error-based SQL injection and exposes internal database error messages and stack traces, revealing implementation details of the backend system.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to reach the vulnerable functionality?
The issue is in the /ws/apitribuna/ultimosVideos endpoint and is described as remotely exploitable. No authentication requirement is stated in the available information.
What information can be exposed through this issue?
Malformed SQL supplied through the limit_videos parameter can trigger database errors and backend stack traces. These responses may disclose internal database and application implementation details.
Is the issue limited to information disclosure?
The available information confirms error-based SQL injection and exposure of error messages and stack traces. It also states that injected SQL syntax could potentially manipulate backend queries, but does not specify the resulting database access or impact.