Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-1476: Gabinete Técnico de Programación's EDD App SQL Data Leak Risk
CVE-2026-1476 · published 9 months ago
Summary
A security flaw in the EDD app developed by Gabinete Técnico de Programación allows hackers to steal sensitive data from the app's database without the app knowing. This puts confidential information at risk of being stolen. Users who use the EDD app should update it or take other security measures to protect their data.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| quatuor | evaluacion_de_desempeno |
All versions
cpe:2.3:a:quatuor:evaluacion_de_desempeno:-:*:*:*:*:*:*:* |
Original advisory text
An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability ...
An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Id_usuario' in ‘/evaluacion_acciones_ver_auto.aspx’, could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.
References
- https://www.incibe.es/en/incibe-cert/notices/aviso/out-band-sql-injection-quatuo... Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-89SQL Injection
Timeline
Published27 Jan 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2026-1476 · NVD
Track software like this
Free during beta