CVE-2026-81674: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') in TOOOLS iSquad

The vulnerability exists because the id_ambito parameter in the '/ws/apiprensa/getVideoNextPrev' endpoint of TOOOLS iSquad is not properly sanitized before being incorporated into a MariaDB SQL query. This improper neutralization of special elements (CWE-89) allows an attacker to inject SQL syntax, interrupting the query execution and causing detailed error messages that expose internal database query structure. The CVSS 4.0 score is 9.3 (critical), reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is available, and the product is not a cloud service.

Successful exploitation can lead to exposure of detailed database error messages and internal query structures, which may facilitate further attacks such as data leakage or unauthorized data manipulation. The vulnerability affects confidentiality, integrity, and availability of the database accessed by the vulnerable endpoint.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to apply input validation and sanitization on the id_ambito parameter to prevent SQL injection. Monitor for updates from TOOOLS regarding official patches or mitigations.