Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-25947 SQL Injection Vulnerabilities in Worklenz Project Management Tool Before v2.1.7 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25947
Post summary
A new SQL Injection vulnerability (CVE-2026-25947) affecting Worklenz Project Management Tool prior to version 2.1.7 has been disclosed. The flaw is present in earlier releases and is a classic SQL injection flaw.
A Boolean-Based Blind SQL Injection (CVE-2026-25947) affects `Worklenz` due to improper ORDER BY clause input validation. This can lead to data exfiltration. #SQLInjection #infosec #Worklenz https://www.pulsepatch.io/posts/cve-2026-25947-worklenz-sql-injection
Post summary
The post discloses a Boolean-based blind SQL injection vulnerability (CVE-2026-25947) in Worklenz caused by inadequate ORDER BY validation, which could enable data exfiltration.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | worklenz | worklenz | - | - | - |