CVE-2026-25947

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-25947

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25947.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-25947

Aliases

GHSA-f2f8-2ppj-85pf

Published

2026-02-10T17:32:56.224Z

Modified

2026-03-02T19:52:29.525568Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Worklenz Boolean-Based Blind SQL Injection via Improper ORDER BY Clause Input Validation

Details

Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25947.json"
}

References

Affected packages

Git / github.com/worklenz/worklenz

Affected ranges

Type: GIT
Repo: https://github.com/worklenz/worklenz
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

9db7b1c02786beaed6ca9798a80ab629147a42a2

Affected versions

Other

angular-version-legacy

v1.*

v1.0.0

v1.0.1

v2.*

v2.0.0

v2.0.1

v2.0.2

v2.0.3

v2.1.0

v2.1.1

v2.1.2

v2.1.3

v2.1.4

v2.1.5

v2.1.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25947.json"