CVE Explorer

CVE-2026-1478

An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Id_usuario' and 'Id_evaluacion’ in ‘/evaluacion_hca_evalua.aspx’, could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored informat

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:89f52af67c3d7c683c65760eeab8c4130155d3c8ac08064936f97affddf3e600

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","product":"Evaluación de Desempeño (EDD)","vendor":"Quatuor","versions":[{"lessThan":"11/12/2025","status":"affected","version":"0","versionType":"date"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:3a2b37a845cd9107ad713ef1b9fcf6f22786dda46039a0c1092137dae8ec4037 · sha256:35a8421c8b46b0b1… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact…

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:3a2b37a845cd9107ad713ef1b9fcf6f22786dda46039a0c1092137dae8ec4037 · sha256:35a8421c8b46b0b1… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:3a2b37a845cd9107ad713ef1b9fcf6f22786dda46039a0c1092137dae8ec4037 · sha256:35a8421c8b46b0b1… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/out-band-sql-injection-quatuor-performance-evaluation"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:3a2b37a845cd9107ad713ef1b9fcf6f22786dda46039a0c1092137dae8ec4037 · sha256:35a8421c8b46b0b1… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer