CVE-2026-25947

Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Worklenz/worklenz/commit/76e5cb0f5dd566fb65586cd3db30ee951c92a32b	Patch
https://github.com/Worklenz/worklenz/releases/tag/v2.1.7	Product Release Notes
https://github.com/Worklenz/worklenz/security/advisories/GHSA-f2f8-2ppj-85pf	Exploit Mitigation Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:worklenz:worklenz:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-10 18:16

Updated : 2026-06-17 10:25

NVD link : CVE-2026-25947

Mitre link : CVE-2026-25947

CVE.ORG link : CVE-2026-25947

JSON object : View

Products Affected

worklenz

worklenz

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-25947", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25947", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-02-10T19:26:10.012909Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Worklenz", "product": "worklenz", "versions": [{"status": "affected", "version": "< 2.1.7"}]}]}], "published": "2026-02-10T18:16:38.423", "references": [{"url": "https://github.com/Worklenz/worklenz/commit/76e5cb0f5dd566fb65586cd3db30ee951c92a32b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Worklenz/worklenz/releases/tag/v2.1.7", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Worklenz/worklenz/security/advisories/GHSA-f2f8-2ppj-85pf", "tags": ["Exploit", "Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7."}, {"lang": "es", "value": "Worklenz es una herramienta de gesti\u00f3n de proyectos. Antes de 2.1.7, se descubrieron m\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en la construcci\u00f3n de consultas SQL del backend que afectaban a los controladores de gesti\u00f3n de proyectos y tareas, a los puntos finales de datos financieros y de informes, a los manejadores de socket.io en tiempo real, y a las caracter\u00edsticas de asignaci\u00f3n y programaci\u00f3n de recursos. La vulnerabilidad ha sido parcheada en la versi\u00f3n v2.1.7."}], "lastModified": "2026-06-17T10:25:28.417", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:worklenz:worklenz:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C488A1A0-AD25-4AF0-B022-3F30C5F88BEC", "versionEndExcluding": "2.1.7"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}