CVE-2026-81673 Multiple Vulnerabilities in TOOOLS' iSquad
Remote attackers can inject SQL via unvalidated parameters in the setVisita endpoint to manipulate visit tracking records and disrupt database operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81673?
CVE-2026-81673 is a critical SQL injection vulnerability in TOOOLS iSquad, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of queries, causing database errors and potentially manipulating visit tracking records. Given the nature of the endpoint, this could also affect the integrity of analytics and the accuracy of records.
Weakness: CWE-89
Which versions are affected by CVE-2026-81673?
How do I fix CVE-2026-81673?
No fix has been published for CVE-2026-81673 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-81673 being exploited?
There is no known exploitation of CVE-2026-81673 in the wild and no public exploit code.
Sources
Also known as GHSA-jrxj-37q3-93g2.