CVE-2026-25947

8.8 highEPSS 0.4%

High (8.8) in worklenz worklenz. EPSS 0.4% chance of exploitation in the next 30 days.

Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-02-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

worklenz:worklenz

References

https://github.com/Worklenz/worklenz/commit/76e5cb0f5dd566fb65586cd3db30ee951c92a32b
https://github.com/Worklenz/worklenz/releases/tag/v2.1.7
https://github.com/Worklenz/worklenz/security/advisories/GHSA-f2f8-2ppj-85pf

Check your stack JSON