CVE-2026-1480

An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Id_usuario' in '/evaluacion_objetivos_anyo_sig_evalua.aspx', could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.

Score

CVSS 4.0 9.3 Critical

Status

Analyzed - cve-coordination@incibe.es

Published

2026-01-27

Last modified

2026-01-27

Weaknesses

CWE-89

Affected products

• Evaluacin De Desempeo Edd (Quatuor)
• Evaluacion De Desempeno (Quatuor)

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/out-band-sql-injection-quatuor-performance-evaluation