Summary
CVE-2026-81674 is a critical SQL injection vulnerability in TOOOLS’ iSquad sports-management platform. The flaw resides in the /ws/apiprensa/getVideoNextPrev API endpoint, where the id_ambito parameter is passed unsanitized into a MariaDB query, allowing a remote, unauthenticated attacker to manipulate database queries. The issue carries a CVSS score of 9.3 (Critical) and requires no privileges or user interaction to exploit.
Technical details
- Root cause: The
id_ambitoparameter received via the/ws/apiprensa/getVideoNextPrevendpoint is concatenated directly into a MariaDB SQL statement without sanitization or parameterization (CWE-89). - Trigger conditions: An attacker sends a crafted HTTP request to the endpoint with malicious SQL syntax in the
id_ambitoparameter. - Attack vector: Network — the endpoint is reachable remotely with no authentication or user interaction required.
- Impact: Injected SQL can break query execution, disclose database error messages and internal query structure, and potentially be leveraged for further data exposure or manipulation depending on database permissions.
- This vulnerability was disclosed alongside five related SQL injection issues in other iSquad endpoints (CVE-2026-81672, 81673, 81675, 81676, 81677).
Affected software
- TOOOLS iSquad — all versions released prior to July 22, 2026.
Severity
- CVSS v4.0 Base Score: 9.3 (Critical)
- Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Mitigation and recommended actions
- Immediate: Upgrade to the iSquad release deployed on or after July 22, 2026, in which TOOOLS states the input validation and sanitization issues were resolved and verified through retesting.
- If patching is not immediately possible: Restrict external network access to the
/ws/apiprensa/and related API paths, deploy a web application firewall rule to block anomalous SQL metacharacters in theid_ambitoand related parameters, and monitor for database error responses that could indicate injection attempts.

