Quick answers
- Is CVE-2026-81673 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81673 being exploited in the wild.
- How severe is CVE-2026-81673?
- Informational severity, with a CVSS score of 9.3, published 27 August 2026.
- Which products and versions are affected?
- TOOOLS iSquad prior to July 22, 2026.
- Is there a fix for CVE-2026-81673?
- A patch was published on 2026-07-22: Fixes deployed to all production instances Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-81673 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-81673?
- Check whether you run TOOOLS iSquad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a SQL injection vulnerability (CWE-89) in the '/ws/apitribuna/setVisita' endpoint of TOOOLS iSquad. The id_video and id_ambito parameters are directly concatenated into MariaDB SQL queries without validation or sanitization. The vulnerability is remotely exploitable over the network with no authentication required. An attacker can inject arbitrary SQL syntax to disrupt query execution, expose database error messages, and potentially manipulate visit tracking records and analytics integrity. The vendor (TOOOLS) has patched this vulnerability; fixes were deployed to all production instances by July 22, 2026, and no action is required by end users.
Affected products
- TOOOLS iSquad prior to July 22, 2026
Timeline
- 2026-08-27: disclosed: Coordinated disclosure via INCIBE-CERT
- 2026-07-22: patched: Fixes deployed to all production instances