CVE-2026-81676: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') in TOOOLS iSquad

The vulnerability exists in the TOOOLS iSquad product at the endpoint '/ws/apitribuna/ultimosVideos', where the 'limit_videos' parameter is used unsafely in a MariaDB SQL query. Because the parameter is concatenated directly without sanitization or parameterization, an attacker can inject SQL syntax to cause errors and manipulate queries. This error-based SQL injection exposes internal database error messages and stack traces, which can aid attackers in understanding the backend system. The CVSS 4.0 base score is 8.8, indicating high severity with network attack vector, no privileges or user interaction required, and high vulnerability confidentiality impact.

Successful exploitation allows a remote attacker to cause SQL syntax errors and potentially manipulate backend database queries. The exposure of internal database error messages and stack traces reveals sensitive implementation details, which could facilitate further attacks or information disclosure. However, there is no indication of direct data modification or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, users should monitor the vendor's communications for updates. Until a fix is available, avoid exposing the vulnerable endpoint publicly or implement input validation and parameterized queries as a temporary measure if possible.