CVE-2026-25947

HIGH

Worklenz < 2.1.7 - SQL Injection in Project and Task Management Controllers

Title source: llm
STIX 2.1

Description

Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.

References (3)

Core 3

Scores

CVSS v3 8.8
EPSS 0.0035
EPSS Percentile 27.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
worklenz/worklenz < 2.1.7
Published Feb 10, 2026
Tracked Since Feb 18, 2026