CVE-2026-1476 CRITICAL

CVE-2026-1476: Out-of-band SQL injection in Quatuor Performance Evaluation

Vendor Quatuor
Product Evaluación de Desempeño (EDD)
Weakness CWE-89 · SQLi
Published January 27, 2026
Last update January 27, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Id_usuario' in ‘/evaluacion_acciones_ver_auto.aspx’, could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.

Key dates

02Disclosure timeline

January 27, 2026 CVE published
January 27, 2026 Record updated