# CVE-2026-81677: TOOOLS iSquad SQL injection in /ws/apiprensa/getVideo

Source: https://junglewise.ai/threats/cve-2026-81677-toools-isquad-sql-injection-in-ws-apiprensa-getvideo  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81677 · Severity: info · CVSS 8.8 · Published 2026-08-27

iSquad is a cross-platform sports analytics platform used for comprehensive sports management. The '/ws/apiprensa/getVideo' endpoint accepts unsanitized user input in the `id_ambito` parameter and directly incorporates it into SQL queries, allowing attackers to inject SQL commands. An exploit could expose sensitive database information, corrupt analytics records, or enable unauthorized data access.

Technologies: [TOOOLS iSquad](https://junglewise.ai/threats/technologies/isquad). Vendors: [TOOOLS](https://junglewise.ai/threats/vendors/toools).

## Quick answers

**Is CVE-2026-81677 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81677 being exploited in the wild.

**How severe is CVE-2026-81677?** Informational severity, with a CVSS score of 8.8, published 27 August 2026.

**Which products and versions are affected?** TOOOLS iSquad versions prior to the one released on July 22, 2026.

**Is there a fix for CVE-2026-81677?** A patch was published on 2026-07-22: Vendor deployed fixes across all production instances Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81677 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-81677?** Check whether you run TOOOLS iSquad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-81677 is a SQL injection vulnerability (CWE-89) in TOOOLS' iSquad REST API endpoint '/ws/apiprensa/getVideo'. The GET parameter `id_ambito` is incorporated directly into MariaDB queries without sanitization or prepared statements. Attackers can inject SQL syntax to break the query structure, triggering database errors and exposing PDOException error messages and internal query logic. The vulnerability is network-accessible, requires no authentication or user interaction, and enables information disclosure and potential query manipulation. The vendor has deployed patches across all production instances; no client action is required.

## Affected products

- TOOOLS iSquad versions prior to the one released on July 22, 2026

## Timeline

- 2026-08-27: disclosed
- 2026-07-22: patched: Vendor deployed fixes across all production instances

## References

- [https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad)

## Related threats

- [TOOOLS iSquad SQL injection in ultimosVideos endpoint](https://junglewise.ai/threats/cve-2026-81676-toools-isquad-sql-injection-in-ultimosvideos-endpoint)
- [TOOOLS iSquad SQL injection in getVideoUltimasSeccion](https://junglewise.ai/threats/cve-2026-81675-toools-isquad-sql-injection-in-getvideoultimasseccion)
- [TOOOLS iSquad SQL injection in getVideoNextPrev endpoint](https://junglewise.ai/threats/cve-2026-81674-toools-isquad-sql-injection-in-getvideonextprev-endpoint)
- [TOOOLS iSquad SQL injection in setVisita endpoint](https://junglewise.ai/threats/cve-2026-81673-toools-isquad-sql-injection-in-setvisita-endpoint)
- [TOOOLS iSquad SQL injection in getVideoSubcanal endpoint](https://junglewise.ai/threats/cve-2026-81672-toools-isquad-sql-injection-in-getvideosubcanal-endpoint)