CVE-2026-81673: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') in TOOOLS iSquad

The vulnerability identified as CVE-2026-81673 affects the TOOOLS iSquad application. Specifically, the '/ws/apitribuna/setVisita' endpoint improperly neutralizes special elements in SQL commands, leading to SQL injection via the id_video and id_ambito parameters. Because these inputs are included in SQL queries without validation or sanitization, an attacker can inject SQL syntax to cause database errors or manipulate data related to visit tracking. This compromises data integrity and the reliability of analytics derived from these records.

Successful exploitation can lead to disruption of database query execution, causing errors and potential manipulation of visit tracking data. This undermines the integrity of analytics and the accuracy of records maintained by the application. The vulnerability is remotely exploitable without authentication, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, restrict access to the vulnerable endpoint and monitor for suspicious activity related to the id_video and id_ambito parameters.