PT-2026-7327 · Worklenz · Worklenz

Prav33N-Sec · Published 2026-02-10 · Updated 2026-02-10 · CVE-2026-25947

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Worklenz versions prior to 2.1.7

Description Worklenz, a project management tool, contains multiple SQL injection flaws in its backend SQL query construction. These flaws affect project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The issue allows for potential unauthorized access and manipulation of data through crafted SQL queries.

Recommendations Update to version 2.1.7 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-25947

GHSA-F2F8-2PPJ-85PF

Affected Products

Worklenz

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25947.json · Exploit
• https://github.com/Worklenz/worklenz/commit/76e5cb0f5dd566fb65586cd3db30ee951c92a32b · Patch
• https://github.com/Worklenz/worklenz/security/advisories/GHSA-f2f8-2ppj-85pf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25947 · Security Note
• https://github.com/Worklenz/worklenz/releases/tag/v2.1.7 · Note
• https://t.me/CVEtracker/44315 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2021372992035426720 · Twitter Post