CVE-2026-1482CWE-89

Out-of-band SQL injection in Quatuor Performance Evaluation

Critical · published January 27, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
30.9
In the wild
Unconfirmed
What it is

🚨 An out-of-band SQL injection lurking in the Performance Evaluation application is exposing sensitive data like a missed appointment that sends your confidential files to a stranger! 🔥 Think of this SQL injection as a sneaky delivery route that allows a thief to access the contents of your locked vault without ever entering the premises. Instead of breaking in, they simply ask the delivery service to hand over the goods from the outside! If exploited, this vulnerability could leak sensitive database information, compromising the confidentiality of data stored within the system. An attacker could extract crucial information without ever being detected by the application, leaving your data vulnerable and exposed. Imagine the fallout if sensitive evaluations or private records made their way into the wrong hands!

Put simply

Think of this SQL injection as a sneaky delivery route that allows a thief to access the contents of your locked vault without ever entering the premises. Instead of breaking in, they simply ask the delivery service to hand over the goods from the outside! This out-of-band SQL injection vulnerability in the 'Id_evaluacion' parameter of the '/evaluacion_objetivos_evalua_definido.aspx' page allows attackers to pull information from the database through external channels, bypassing standard application responses.

What to do

If exploited, this vulnerability could leak sensitive database information, compromising the confidentiality of data stored within the system. An attacker could extract crucial information without ever being detected by the application, leaving your data vulnerable and exposed. Imagine the fallout if sensitive evaluations or private records made their way into the wrong hands! Immediately patch the application to the latest version released by Gabinete Técnico de Programación. Review and sanitize input parameters, especially those involving SQL queries, to prevent such injection attacks in the future. Regularly audit your database access controls and monitor for unusual external requests. You can tackle this vulnerability and strengthen your defenses! Stay vigilant and proactive to secure your application. 🛡️

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00381 · 30.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-01-27T16:32Z
EPSS history
Timeline
  • 27 JAN 16:32Z
    Out-of-band SQL injection in Quatuor Performance Evaluation
    cvelistv5