# CVE-2026-81676: TOOOLS iSquad SQL injection in ultimosVideos endpoint

Source: https://junglewise.ai/threats/cve-2026-81676-toools-isquad-sql-injection-in-ultimosvideos-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81676 · Severity: info · CVSS 8.8 · Published 2026-08-27

TOOOLS iSquad is a cross-platform sports analytics platform used for comprehensive sports management with Big Data and AI capabilities. A SQL injection vulnerability in the '/ws/apitribuna/ultimosVideos' endpoint allows unauthenticated remote attackers to inject malicious SQL commands through the limit_videos parameter, potentially exposing sensitive database information, manipulating queries, and disrupting analytics data integrity.

Technologies: [TOOOLS iSquad](https://junglewise.ai/threats/technologies/isquad). Vendors: [TOOOLS](https://junglewise.ai/threats/vendors/toools).

## Quick answers

**Is CVE-2026-81676 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81676 being exploited in the wild.

**How severe is CVE-2026-81676?** Informational severity, with a CVSS score of 8.8, published 27 August 2026.

**Which products and versions are affected?** TOOOLS iSquad prior to July 22, 2026.

**Is there a fix for CVE-2026-81676?** A patch was published on 2026-07-22: Fix deployed to all production instances Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81676 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-81676?** Check whether you run TOOOLS iSquad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an error-based SQL injection vulnerability (CWE-89) in the '/ws/apitribuna/ultimosVideos' API endpoint where the limit_videos parameter is directly concatenated into a MariaDB SQL query without sanitization or parameterization. The vulnerability is remotely exploitable over the network with no authentication or user interaction required (CVSS vector AV:N/AC:L/AT:N/PR:N/UI:N). An attacker can inject SQL syntax to cause query syntax errors, exposing internal database error messages and stack traces through the Slim framework's error handler, revealing backend implementation details. The vulnerability has been patched by TOOOLS; fixes were deployed to all production instances as of the advisory date, and internal SQL injection testing confirmed the endpoints are no longer exploitable.

## Affected products

- TOOOLS iSquad prior to July 22, 2026

## Timeline

- 2026-08-27: disclosed: Coordinated disclosure by INCIBE-CERT (INCIBE-2026-587)
- 2026-07-22: patched: Fix deployed to all production instances
- 2026-08-27: other: CVE-2026-81676 assigned with CVSS v4.0 score 8.8

## References

- [https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad)

## Related threats

- [TOOOLS iSquad SQL injection in /ws/apiprensa/getVideo](https://junglewise.ai/threats/cve-2026-81677-toools-isquad-sql-injection-in-ws-apiprensa-getvideo)
- [TOOOLS iSquad SQL injection in getVideoUltimasSeccion](https://junglewise.ai/threats/cve-2026-81675-toools-isquad-sql-injection-in-getvideoultimasseccion)
- [TOOOLS iSquad SQL injection in getVideoNextPrev endpoint](https://junglewise.ai/threats/cve-2026-81674-toools-isquad-sql-injection-in-getvideonextprev-endpoint)
- [TOOOLS iSquad SQL injection in setVisita endpoint](https://junglewise.ai/threats/cve-2026-81673-toools-isquad-sql-injection-in-setvisita-endpoint)
- [TOOOLS iSquad SQL injection in getVideoSubcanal endpoint](https://junglewise.ai/threats/cve-2026-81672-toools-isquad-sql-injection-in-getvideosubcanal-endpoint)