PT-2026-7327 · Worklenz · Worklenz

Prav33N-Sec · Publicado 2026-02-10 · Atualizado 2026-02-10 · CVE-2026-25947

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Worklenz versions prior to 2.1.7

Description Worklenz, a project management tool, contains multiple SQL injection flaws in its backend SQL query construction. These flaws affect project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The issue allows for potential unauthorized access and manipulation of data through crafted SQL queries.

Recommendations Update to version 2.1.7 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-25947

GHSA-F2F8-2PPJ-85PF

Produtos afetados

Worklenz

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25947.json · Exploit
• https://github.com/Worklenz/worklenz/commit/76e5cb0f5dd566fb65586cd3db30ee951c92a32b · Correção
• https://github.com/Worklenz/worklenz/security/advisories/GHSA-f2f8-2ppj-85pf · Aviso do Fabricante
• https://github.com/Worklenz/worklenz/releases/tag/v2.1.7 · Nota
• https://osv.dev/vulnerability/CVE-2026-25947 · Aviso do Fabricante
• https://t.me/CVEtracker/44315 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2021372992035426720 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25947 · Nota de Segurança