CVE-2026-25947 | THREATINT

Description

Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.

PUBLISHED Reserved 2026-02-09 | Published 2026-02-10 | Updated 2026-02-10 | Assigner GitHub_M

HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

< 2.1.7

affected

References

github.com/...rklenz/security/advisories/GHSA-f2f8-2ppj-85pf

github.com/...ommit/76e5cb0f5dd566fb65586cd3db30ee951c92a32b

github.com/Worklenz/worklenz/releases/tag/v2.1.7

cve.org (CVE-2026-25947)

nvd.nist.gov (CVE-2026-25947)

Download JSON