Vulnerability · Published Feb 10, 2026 · Assigned by GitHub_M
CVE-2026-25947Worklenz Boolean-Based Blind SQL Injection via Improper ORDER BY Clause Input Validation
High 8.8
In plain English
A high-severity SQL injection in worklenz from Worklenz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 63.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/Worklenz/worklenz/security/advisories/GHSA-f2f8-2ppj-85pf x_refsource_CONFIRM
- https://github.com/Worklenz/worklenz/commit/76e5cb0f5dd566fb65586cd3db30ee951c92a32b x_refsource_MISC
- https://github.com/Worklenz/worklenz/releases/tag/v2.1.7 x_refsource_MISC