CVE-2026-81672: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') in TOOOLS iSquad

This vulnerability in TOOOLS iSquad involves improper neutralization of special elements in SQL commands (CWE-89) at the '/ws/apiprensa/getVideoSubcanal' endpoint. The 'id_video' parameter is not sanitized before being used in SQL queries, leading to SQL injection. Exploitation results in execution errors that reveal internal file paths and stack traces via the Slim framework error handler, compounding the impact by disclosing sensitive internal information. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized SQL command execution, potentially compromising database integrity and confidentiality. The exposure of internal file paths and stack traces increases the risk by providing attackers with detailed information about the internal system, which can facilitate further attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and implement input validation and sanitization on the 'id_video' parameter to mitigate risk.