CVE-2026-81675: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') in TOOOLS iSquad

The vulnerability CVE-2026-81675 affects the TOOOLS iSquad product and involves improper neutralization of special elements used in an SQL command (CWE-89). The 'id_seccion' parameter in the '/ws/apiprensa/getVideoUltimasSeccion' endpoint is vulnerable to SQL injection because it is directly embedded in a complex SQL query involving grouping and sorting. An attacker can inject SQL code to disrupt the query, cause errors, and potentially manipulate the content retrieval logic. No patch or official remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation can lead to disruption of database queries, exposure of internal query logic through error messages, and potentially broader manipulation of content retrieval mechanisms. This can compromise data integrity and confidentiality within the affected application. The CVSS 4.0 base score of 9.3 indicates a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable endpoint to untrusted users or implement input validation and parameterized queries as a temporary mitigation if possible.