Multiple Vulnerabilities in TOOOLS' iSquad
iSquad, versions prior to the one released on July 22, 2026.
INCIBE has coordinated the disclosure of 6 vulnerabilities: 4 with critical severity and 2 with high severity, affecting TOOOLS’ iSquad, a cross-platform sports analytics software that incorporates Big Data and AI systems for comprehensive sports management. The vulnerabilities were discovered by DylanCV.
These vulnerabilities have been assigned the following codes, CVSS v4.0 base score, CVSS vector, and CWE vulnerability type for each vulnerability:
- CVE-2026-81672: CVSS v4.0: 9.3 | CVSS AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CWE-89
- CVE-2026-81673: CVSS v4.0: 9.3 | CVSS AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CWE-89
- CVE-2026-81674: CVSS v4.0: 9.3 | CVSS AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CWE-89
- CVE-2026-81675: CVSS v4.0: 9.3 | CVSS AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | CWE-89
- CVE-2026-81676: CVSS v4.0: 8.8 | CVSS AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | CWE-89
- CVE-2026-81677: CVSS v4.0: 8.8 | CVSS AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | CWE-89
The vulnerabilities have been resolved by the TOOOLS team.
The reported attack vectors have been reproduced, confirming that they are no longer exploitable and do not return internal error messages. Additionally, an automated SQL injection retest was performed on the affected endpoints with no findings.
As an additional and proactive measure, input validation and sanitization in the application’s comments module have also been strengthened.
iSquad is a service hosted and operated by Toools S.L.; the fixes have been deployed across all production instances, and no action is required on the part of end users.
- CVE-2026-81672: SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes internal file paths and complete stack traces through the Slim framework’s error handler, which increases the severity due to the combination of information disclosure and SQL injection.
- CVE-2026-81673: the ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of queries, causing database errors and potentially manipulating visit tracking records. Given the nature of the endpoint, this could also affect the integrity of analytics and the accuracy of records.
- CVE-2026-81674: the endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database error messages and exposes the internal structure of the queries, which could facilitate further exploitation.
- CVE-2026-81675: the endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and cause database errors, exposing the internal logic of the queries. The complexity of the query increases the potential impact, as it could allow for broader manipulation of the content retrieval logic.
- CVE-2026-81676: a vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and potentially manipulate backend queries. The issue results in an error-based SQL injection and exposes internal database error messages and stack traces, revealing implementation details of the backend system.
- CVE-2026-81677: the ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via PDOException. This confirms that user input is being incorporated directly into SQL statements without proper sanitization or the use of prepared statements.
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-81672 | Crítica | No | TOOOLS |
| CVE-2026-81673 | Crítica | No | TOOOLS |
| CVE-2026-81674 | Crítica | No | TOOOLS |
| CVE-2026-81675 | Crítica | No | TOOOLS |
| CVE-2026-81676 | Alta | No | TOOOLS |
| CVE-2026-81677 | Alta | No | TOOOLS |
