Vulnerability Description
The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via PDOException. This confirms that user input is being incorporated directly into SQL statements without proper sanitization or the use of prepared statements.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-81677?
CVE-2026-81677 is a documented vulnerability. The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL syntax that breaks the underlying structure...
How severe is CVE-2026-81677?
CVSS scoring is not yet available for CVE-2026-81677. Check NVD for updates.
Is there a patch for CVE-2026-81677?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.