PT-2026-20260 · Jorani · Jorani

Published 2026-02-17 · Updated 2026-03-23 · CVE-2025-67102

Positive Technologies · (AI Summary)

CVSS v3.1

7.6

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Jorani versions prior to 1.0.5

Description A SQL injection issue exists in the alldayoffs feature of the software. An authenticated attacker can execute arbitrary SQL commands through the entity parameter.

Recommendations Update to version 1.0.5 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-67102

Affected Products

Jorani

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-67102 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67102 · Vendor Advisory
• https://github.com/bbalet/jorani · Note
• https://twitter.com/VulmonFeeds/status/2023974734614933982 · Twitter Post
• https://t.me/cveNotify/155118 · Telegram Post
• https://helx.io/blog/advisory-jorani · Note
• https://twitter.com/infoflowcloud/status/2036025619352285427 · Twitter Post
• https://twitter.com/CVEnew/status/2036024273471742333 · Twitter Post