# CVE-2026-81674: TOOOLS iSquad SQL injection in getVideoNextPrev endpoint

Source: https://junglewise.ai/threats/cve-2026-81674-toools-isquad-sql-injection-in-getvideonextprev-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81674 · Severity: info · CVSS 9.3 · Published 2026-08-27

iSquad is a sports analytics platform that combines Big Data and AI for comprehensive sports management. The '/ws/apiprensa/getVideoNextPrev' endpoint contains an SQL injection vulnerability via unsanitized input in the id_ambito parameter, allowing attackers to inject SQL commands that disrupt database queries and expose internal database structure and error messages. This information disclosure could facilitate further attacks against the system.

Technologies: [TOOOLS iSquad](https://junglewise.ai/threats/technologies/isquad). Vendors: [TOOOLS](https://junglewise.ai/threats/vendors/toools).

## Quick answers

**Is CVE-2026-81674 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81674 being exploited in the wild.

**How severe is CVE-2026-81674?** Informational severity, with a CVSS score of 9.3, published 27 August 2026.

**Which products and versions are affected?** TOOOLS iSquad prior to July 22, 2026.

**Is there a fix for CVE-2026-81674?** A patch was published on 2026-07-22: Fix deployed by TOOOLS across all production instances Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81674 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-81674?** Check whether you run TOOOLS iSquad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-81674 is an error-based SQL injection vulnerability in the '/ws/apiprensa/getVideoNextPrev' endpoint caused by improper input validation of the id_ambito parameter. Unsanitized user input is directly concatenated into a MariaDB SQL query without use of prepared statements or parameterized queries. A remote, unauthenticated attacker can send malicious SQL syntax via the id_ambito parameter to interrupt query execution, triggering database error messages that expose internal query structure and implementation details. The vulnerability enables information disclosure through detailed error messages; a patch has been deployed by TOOOLS across all production instances.

## Affected products

- TOOOLS iSquad prior to July 22, 2026

## Timeline

- 2026-08-27: disclosed: Coordinated disclosure by INCIBE
- 2026-07-22: patched: Fix deployed by TOOOLS across all production instances

## References

- [https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad)

## Related threats

- [TOOOLS iSquad SQL injection in /ws/apiprensa/getVideo](https://junglewise.ai/threats/cve-2026-81677-toools-isquad-sql-injection-in-ws-apiprensa-getvideo)
- [TOOOLS iSquad SQL injection in ultimosVideos endpoint](https://junglewise.ai/threats/cve-2026-81676-toools-isquad-sql-injection-in-ultimosvideos-endpoint)
- [TOOOLS iSquad SQL injection in getVideoUltimasSeccion](https://junglewise.ai/threats/cve-2026-81675-toools-isquad-sql-injection-in-getvideoultimasseccion)
- [TOOOLS iSquad SQL injection in setVisita endpoint](https://junglewise.ai/threats/cve-2026-81673-toools-isquad-sql-injection-in-setvisita-endpoint)
- [TOOOLS iSquad SQL injection in getVideoSubcanal endpoint](https://junglewise.ai/threats/cve-2026-81672-toools-isquad-sql-injection-in-getvideosubcanal-endpoint)