What’s Vulnerable › Vulnerabilities
CVE-2026-81676: Multiple Vulnerabilities in TOOOLS' iSquad
- Severity: high (CVSS 8.8 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-27 · updated 2026-08-28
- Weakness: CWE-89
Description
A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and potentially manipulate backend queries. The issue results in an error-based SQL injection and exposes internal database error messages and stack traces, revealing implementation details of the backend system.
Affected products
- TOOOLS iSquad: before 22/07/2026 — fixed in 22/07/2026
How to fix
Upgrade to a fixed version: TOOOLS iSquad 22/07/2026. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-81676 or the next vulnerability affects your stack