SQL Injection Vulnerability in Toools Isquad Affecting Visit Tracking
CVE-2026-81673

9.3CRITICAL

Key Information:

Vendor

Toools

Status
Isquad
Vendor
CVE Published:
27 August 2026

What is CVE-2026-81673?

The Toools Isquad application features an endpoint, '/ws/apitribuna/setVisita', that is exposed to SQL injection vulnerabilities through improperly validated parameters, specifically 'id_video' and 'id_ambito'. This lack of input sanitization allows malicious actors to manipulate SQL queries. As a result, attackers can introduce harmful SQL syntax, leading to erroneous database operations and potential disruption of visit tracking functionality. Such vulnerabilities threaten not only data integrity but also the reliability of analytics and associated records within the application.

Affected Version(s)

iSquad 0 < 22/07/2026

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...
patch

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

DylanCV
.