CVE-2026-81674
CriticalCVSS 9.3Summary
The endpoint '/ws/apiprensa/getVideoNextPrev' is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database error messages and exposes the internal structure of the queries.
Risk Assessment
An attacker can obtain detailed database information and potentially exploit it for further attacks.
Recommendation
Use parameterized queries and input validation for the id_ambito parameter.
Original NVD description (English source)
The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database error messages and exposes the internal structure of the queries, which could facilitate further exploitation.