CVE-2026-25947

HIGH

8.8

Descricao

Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.

Detalhes CVE

Pontuacao CVSS v3.18.8

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado2/10/2026

Ultima modificacao2/23/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

worklenz:worklenz

Fraquezas (CWE)

CWE-89

Referencias

https://github.com/Worklenz/worklenz/commit/76e5cb0f5dd566fb65586cd3db30ee951c92a32b(security-advisories@github.com)

https://github.com/Worklenz/worklenz/releases/tag/v2.1.7(security-advisories@github.com)

https://github.com/Worklenz/worklenz/security/advisories/GHSA-f2f8-2ppj-85pf(security-advisories@github.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.