CVE-2026-25947

Katalog CVE

CVSS 8.8 · High EPSS 0,61%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada worklenz. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.

Rincian

Terbit di NVD

10 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Worklenz/worklenz/security/advisories/GHSA-f2f8-2ppj-85pf exploit · mitigasi · patch · advisory vendor
• https://github.com/Worklenz/worklenz/commit/76e5cb0f5dd566fb65586cd3db30ee951c92a32b patch
• https://github.com/Worklenz/worklenz/releases/tag/v2.1.7 product · release notes