SQL Injection Vulnerability in MariaDB Affected by ISquad Tools
CVE-2026-81676

8.8HIGH

Key Information:

Vendor

Toools

Status
Isquad
Vendor
CVE Published:
27 August 2026

What is CVE-2026-81676?

A vulnerability exists in ISquad Tools related to the '/ws/apitribuna/ultimosVideos' endpoint, where the limit_videos parameter is vulnerable to SQL injection. Lack of proper sanitization allows attackers to inject SQL syntax, triggering error-based SQL injection and revealing internal database error messages and stack traces. This can lead to unauthorized manipulation of backend queries and expose sensitive implementation details of the system.

Affected Version(s)

iSquad 0 < 22/07/2026

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...
patch

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

DylanCV
.