CVE-2026-1480CWE-89

Out-of-band SQL injection in Quatuor Performance Evaluation

Critical · published January 27, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
30.0
In the wild
Unconfirmed
What it is

🚨 An out-of-band SQL injection is lurking in the shadows of your Performance Evaluation application, ready to snatch sensitive information! 🔥 Think of it like a sneaky spy accessing your top-secret files from outside the office without ever stepping foot inside. The attacker can pull out confidential data through a backdoor, bypassing the front desk completely! If exploited, this vulnerability could lead to a catastrophic breach of personal information stored in your database. An attacker could extract sensitive data—potentially exposing user credentials, financial records, or more—making it a critical threat to your organization’s confidentiality and trust. This is a serious wake-up call for anyone using this application!

Put simply

Think of it like a sneaky spy accessing your top-secret files from outside the office without ever stepping foot inside. The attacker can pull out confidential data through a backdoor, bypassing the front desk completely! This out-of-band SQL injection vulnerability in the 'Id_usuario' parameter allows attackers to extract data from the database through external channels, undermining the confidentiality of stored information without the application returning the data directly.

What to do

If exploited, this vulnerability could lead to a catastrophic breach of personal information stored in your database. An attacker could extract sensitive data—potentially exposing user credentials, financial records, or more—making it a critical threat to your organization’s confidentiality and trust. This is a serious wake-up call for anyone using this application! Immediately review and patch the vulnerable application to the latest version provided by Gabinete Técnico de Programación. Implement input validation and prepared statements to safeguard against SQL injection. Regularly audit your SQL query practices to ensure no further vulnerabilities lurk in the shadows! You've got this! Follow these steps and you'll be one step closer to securing your applications and protecting your users! 🛡️

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00372 · 30.0th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-01-27T16:31Z
EPSS history
Timeline
  • 27 JAN 16:31Z
    Out-of-band SQL injection in Quatuor Performance Evaluation
    cvelistv5