CRITICAL 9.3 NVD

CVE-2026-81674

The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a Mari

The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database error messages and exposes the internal structure of the queries, which could facilitate further exploitation.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad

Published: 2026-08-27 · Source: NVD · Feed updated: 2026-08-27

This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-08-27 via NVD.

Risk Timeline

CVE Disclosed2026-08-27 · -1 days ago

Remediation Resources

Official Advisory

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-to

vulnfeed aggregates 11337 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.