Quick answers
- Is CVE-2026-81672 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81672 being exploited in the wild.
- How severe is CVE-2026-81672?
- Informational severity, with a CVSS score of 9.3, published 27 August 2026.
- Which products and versions are affected?
- TOOOLS iSquad prior to July 22, 2026.
- Is there a fix for CVE-2026-81672?
- A patch was published on 2026-07-22: Patch released and deployed across all production instances Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-81672 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-81672?
- Check whether you run TOOOLS iSquad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a SQL injection vulnerability (CWE-89) in the '/ws/apiprensa/getVideoSubcanal' endpoint caused by improper handling of the id_video parameter. The application fails to sanitize user input before constructing SQL queries, and additionally exposes sensitive information through Slim framework error handlers. The vulnerability is network-accessible (AV:N) with no authentication or user interaction required (PR:N/UI:N). An attacker can inject SQL syntax to disrupt query execution, extract database contents, or manipulate data. The vendor has patched this vulnerability and confirmed the fix eliminates error-based SQL injection and prevents stack trace exposure.
Affected products
- TOOOLS iSquad prior to July 22, 2026
Timeline
- 2026-08-27: disclosed
- 2026-07-22: patched: Patch released and deployed across all production instances
- 2026-08-27: other: INCIBE-CERT advisory published (INCIBE-2026-587)