Log in Start free

Vulnerability · Published Jan 27, 2026 · Assigned by INCIBE

CVE-2026-1473Out-of-band SQL injection in Quatuor Performance Evaluation

Critical 9.3

In plain English

A critical-severity SQL injection in Evaluación de Desempeño (EDD) from Quatuor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.4%top 67.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Id_usuario’ in '/evaluacion_competencias_evalua.aspx', could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.

Affected products (as reported)

VendorProductVersions
Quatuor Evaluación de Desempeño (EDD) All versions

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

References