Toools iSquad up to 21/6 ultimosVideos limit_videos sql injection

Summaryinfo

A vulnerability categorized as critical has been discovered in Toools iSquad up to 21/6. This impacts an unknown function of the file /ws/apitribuna/ultimosVideos. Such manipulation of the argument limit_videos leads to sql injection. This vulnerability is uniquely identified as CVE-2026-81676. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Toools iSquad up to 21/6. It has been rated as critical. Affected by this issue is an unknown functionality of the file /ws/apitribuna/ultimosVideos. The manipulation of the argument limit_videos with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and potentially manipulate backend queries. The issue results in an error-based SQL injection and exposes internal database error messages and stack traces, revealing implementation details of the backend system.

The advisory is shared for download at incibe.es. This vulnerability is handled as CVE-2026-81676 since 08/27/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1505.

Upgrading to version 22, 07 or 2026 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Toools

Name

• iSquad

Version

• 6
• 21

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion