The vulnerability is a classic SQL injection flaw in the /ws/apiprensa/getVideoSubcanal endpoint, caused by failure to sanitize the id_video query parameter. When an attacker supplies crafted input, the application constructs a malformed SQL query that can lead to execution of arbitrary database commands. The Slim framework's default error handler then returns full stack traces and internal file paths, amplifying the impact by leaking sensitive information.

The flaw affects the iSquad web service, a product operated by Toools S.L. The vendor has released patches that address the injection vulnerability and strengthen input validation in the comments module. All production instances were updated, so users of the official service no longer need to intervene. No specific version numbers are disclosed in the advisory, but the fix has been rolled out across the entire deployment.

The CVSS score is 9.3, signalling a critical vulnerability, and the advisory notes that the flaw has already been remediated, thus eliminating the risk of exploitation. No EPSS score is published and the issue is not listed in CISA's KEV catalog. The attack vector is remote, via HTTP requests to the API endpoint, but because the necessary fixes are already deployed server‑side, end users face no available attack surface. Monitoring for anomalous access patterns and ensuring proper authentication remains prudent.