CVEvulnerability
CVE-2026-25947
8.8 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2026-02-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-89
Description
Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.
Affected configurations
• worklenz worklenz (< 2.1.7)
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://github.com/Worklenz/worklenz/commit/76e5cb0f5dd566fb65586cd3db30ee951c92a32b Patch
- https://github.com/Worklenz/worklenz/releases/tag/v2.1.7 Product, Release Notes
- https://github.com/Worklenz/worklenz/security/advisories/GHSA-f2f8-2ppj-85pf Exploit, Mitigation, Patch, Vendor Advisory