CVE-2026-81675
Received Received - Intake

SQL Injection in Video Content Management System

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and cause database errors, exposing the internal logic of the queries. The complexity of the query increases the potential impact, as it could allow for broader manipulation of the content retrieval logic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81675
EUVD
EUVD-2026-67011

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an SQL injection in the endpoint '/ws/apiprensa/getVideoUltimasSeccion' where the id_seccion parameter is directly embedded in a complex SQL query. Attackers can inject SQL syntax to disrupt the query, causing database errors and exposing internal query logic. The query's complexity increases the potential impact.

Detection Guidance

To detect this SQL injection vulnerability, monitor the endpoint '/ws/apiprensa/getVideoUltimasSeccion' for unusual input patterns in the id_seccion parameter. Check web server logs for requests containing SQL syntax like quotes, semicolons, or keywords such as UNION, SELECT, or DROP. Use tools like SQLmap to test for injection by sending crafted payloads to the parameter.

Impact Analysis

An attacker could exploit this to cause database errors, disrupt operations, or manipulate content retrieval. The high CVSS score (9.3) indicates significant risk as it requires no privileges or user interaction and has high impact on confidentiality and integrity.

Compliance Impact

This SQL injection vulnerability could lead to unauthorized data access or manipulation, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Immediately apply input validation to the id_seccion parameter, ensuring it only accepts expected numeric or alphanumeric values. Use parameterized queries or prepared statements to separate SQL code from data. Update the application to sanitize inputs and restrict special characters. Consider deploying a web application firewall to block malicious requests targeting this endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81675. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart