CVE-2026-1477

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1477", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "state": "PUBLISHED", "assignerShortName": "INCIBE", "dateReserved": "2026-01-27T09:25:54.379Z", "datePublished": "2026-01-27T16:30:04.356Z", "dateUpdated": "2026-01-27T20:52:11.854Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Evaluaci\u00f3n de Desempe\u00f1o (EDD)", "vendor": "Quatuor", "versions": [{"status": "affected", "version": "All versions"}]}], "credits": [{"lang": "en", "type": "finder", "value": "\u00d3scar Atienza Vendrell"}], "datePublic": "2026-01-27T16:19:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete T\u00e9cnico de Programaci\u00f3n. Exploiting this vulnerability in the parameter 'Id_usuario' and 'Id_evaluacion\u2019 in \u2018/evaluacion_competencias_evalua_old.aspx\u2019, could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information."}], "value": "An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete T\u00e9cnico de Programaci\u00f3n. Exploiting this vulnerability in the parameter 'Id_usuario' and 'Id_evaluacion\u2019 in \u2018/evaluacion_competencias_evalua_old.aspx\u2019, could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2026-01-27T16:30:04.356Z"}, "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/out-band-sql-injection-quatuor-performance-evaluation"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The vulnerabilities have been resolved in the latest version of the application, released on November 12, 2025, and are no longer exploitable."}], "value": "The vulnerabilities have been resolved in the latest version of the application, released on November 12, 2025, and are no longer exploitable."}], "source": {"discovery": "EXTERNAL"}, "title": "Out-of-band SQL injection in Quatuor Performance Evaluation", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T19:48:53.667679Z", "id": "CVE-2026-1477", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T20:52:11.854Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1477", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-27T19:48:53.667679Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T19:49:26.477Z"}}], "cna": {"title": "Out-of-band SQL injection in Quatuor Performance Evaluation", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "\u00d3scar Atienza Vendrell"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Quatuor", "product": "Evaluaci\u00f3n de Desempe\u00f1o (EDD)", "versions": [{"status": "affected", "version": "All versions"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The vulnerabilities have been resolved in the latest version of the application, released on November 12, 2025, and are no longer exploitable.", "supportingMedia": [{"type": "text/html", "value": "The vulnerabilities have been resolved in the latest version of the application, released on November 12, 2025, and are no longer exploitable.", "base64": false}]}], "datePublic": "2026-01-27T16:19:00.000Z", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/out-band-sql-injection-quatuor-performance-evaluation"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete T\u00e9cnico de Programaci\u00f3n. Exploiting this vulnerability in the parameter 'Id_usuario' and 'Id_evaluacion\u2019 in \u2018/evaluacion_competencias_evalua_old.aspx\u2019, could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.", "supportingMedia": [{"type": "text/html", "value": "An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete T\u00e9cnico de Programaci\u00f3n. Exploiting this vulnerability in the parameter 'Id_usuario' and 'Id_evaluacion\u2019 in \u2018/evaluacion_competencias_evalua_old.aspx\u2019, could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2026-01-27T16:30:04.356Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1477", "state": "PUBLISHED", "dateUpdated": "2026-01-27T20:52:11.854Z", "dateReserved": "2026-01-27T09:25:54.379Z", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "datePublished": "2026-01-27T16:30:04.356Z", "assignerShortName": "INCIBE"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Evaluaci\u00f3n de Desempe\u00f1o (EDD)", "vendor": "Quatuor", "versions": [{"status": "affected", "version": "All versions"}]}], "source": "cve-coordination@incibe.es"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:quatuor:evaluacion_de_desempeno:-:*:*:*:*:*:*:*", "matchCriteriaId": "66ECBB1A-4822-4186-9C8B-49740C8B52A4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete T\u00e9cnico de Programaci\u00f3n. Exploiting this vulnerability in the parameter 'Id_usuario' and 'Id_evaluacion\u2019 in \u2018/evaluacion_competencias_evalua_old.aspx\u2019, could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n SQL fuera de banda (OOB SQLi) ha sido detectada en la aplicaci\u00f3n de Evaluaci\u00f3n del Desempe\u00f1o (EDD) desarrollada por Gabinete T\u00e9cnico de Programaci\u00f3n. La explotaci\u00f3n de esta vulnerabilidad en los par\u00e1metros 'Id_usuario' e 'Id_evaluacion' en '/evaluacion_competencias_evalua_old.aspx' podr\u00eda permitir a un atacante extraer informaci\u00f3n sensible de la base de datos a trav\u00e9s de canales externos, sin que la aplicaci\u00f3n afectada devuelva los datos directamente, comprometiendo la confidencialidad de la informaci\u00f3n almacenada."}], "id": "CVE-2026-1477", "lastModified": "2026-06-17T10:15:51.803", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve-coordination@incibe.es", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1477", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-27T19:48:53.667679Z", "version": "2.0.3"}}]}, "published": "2026-01-27T17:16:11.137", "references": [{"source": "cve-coordination@incibe.es", "tags": ["Third Party Advisory"], "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/out-band-sql-injection-quatuor-performance-evaluation"}], "sourceIdentifier": "cve-coordination@incibe.es", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "cve-coordination@incibe.es", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T02:05:56.020214+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest version of Quatuor Evaluaci\u00f3n de Desempe\u00f1o released on November 12, 2025, which contains the fix.", "If an immediate update is unavailable, sanitize the 'Id_usuario' and 'Id_evaluacion' parameters to accept only numeric data, blocking potentially malicious SQL code.", "If sanitization cannot be done, isolate the database to prevent outbound connections from the application server, disrupting exfiltration but potentially affecting legitimate functionality."], "summary": {"action": "Patch", "impact": "Out\u2011of\u2011band SQL injection allowing external extraction of confidential data"}, "threat_synthesis": {"affected_systems": "The affected system is Quatuor:Evaluaci\u00f3n de Desempe\u00f1o (EDD). No specific version information is provided in the data, so the impact applies to all installations until patched.", "description_and_impact": "An out\u2011of\u2011band SQL injection vulnerability exists in the Performance Evaluation (EDD) application built by Gabinete T\u00e9cnico de Programaci\u00f3n. The flaw is triggered by the parameters 'Id_usuario' and 'Id_evaluacion' in the URL '/evaluacion_competencias_evalua_old.aspx'. An attacker can inject malicious SQL that is executed by the database and relayed through an external channel, providing the attacker with the contents of sensitive tables without the application returning the data directly. This attack compromises the confidentiality of stored information and can expose the full contents of the underlying database if the malicious payload succeeds.", "risk_and_exploitability": "The vulnerability has a CVSS score of 9.3, indicating high severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation at the moment, and it is not listed in the CISA KEV catalog. Attackers would need network access that allows the OOB payload to reach an external channel, and the vulnerability enables sensitive data extraction without the application returning it directly. The only mitigation is a patch, released on November 12, 2025, which eliminates the vulnerability."}}}}, "created": "2026-01-28T12:22:43.341619+00:00", "updated": "2026-04-18T02:15:05.885266+00:00", "vendors": ["quatuor", "quatuor$PRODUCT$evaluacion_de_desempeno"]}