The endpoint '/ws/apiprensa/getVideoNextPrev' was found to allow an unauthenticated attacker to inject raw SQL through the id_ambito parameter. Because the application incorporated this input directly into a MariaDB query without any sanitisation, crafted payloads could terminate the valid query and return detailed database error messages. These error messages revealed the internal structure of the queries, giving the attacker a foothold for further exploitation and potentially enabling the read or alteration of database contents, thereby compromising data confidentiality and integrity.

The vulnerability affects the iSquad service offered by TOOOLS S.L. No specific product version was disclosed, but the issue existed prior to the release of the security update. The official fix has been deployed across all production instances, and an additional strengthening of input validation and sanitization has been added to the comments module. End‑users of the patched service now require no additional action.

The CVSS score of 9.3 underscores a high‑severity risk due to remote, unauthenticated exploitation. EPSS data is not available, and the CVE is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported. In a vulnerable environment, an attacker could exercise the endpoint with malicious id_ambito values, trigger error messages, and use the exposed query structure for further attacks. With the remediation now in place across production, the immediate risk has been mitigated, but the high score highlights the necessity of maintaining the applied patch.