{"id":"CVE-2026-25947","aliases":["EUVD-2026-6752","GHSA-f2f8-2ppj-85pf"],"status":"published","title":"Worklenz Boolean-Based Blind SQL Injection via Improper ORDER BY Clause Input Validation","description":"Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00424,"percentile":0.36982,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-02-10T17:32:56Z","modified":"2026-11-04T02:47:45Z","products":[{"vendor":"worklenz","product":"worklenz"}],"references":[{"url":"https://github.com/Worklenz/worklenz/security/advisories/GHSA-f2f8-2ppj-85pf","tags":["x_refsource_CONFIRM","Exploit","Mitigation","Patch","Vendor Advisory","advisory"]},{"url":"https://github.com/Worklenz/worklenz/commit/76e5cb0f5dd566fb65586cd3db30ee951c92a32b","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/Worklenz/worklenz/releases/tag/v2.1.7","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25947.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25947","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85388.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85388","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/worklenz-through-3.0.0-sql-injection-via-the-sort-field-query-parameter","tags":["advisory"]},{"url":"https://github.com/Worklenz/worklenz/issues/395","tags":["report"]},{"url":"https://github.com/Worklenz/worklenz","tags":["package"]},{"url":"https://github.com/Worklenz/worklenz/blob/v3.0.0/worklenz-backend/src/controllers/job-titles-controller.ts","tags":["article"]},{"url":"https://github.com/Worklenz/worklenz/blob/v3.0.0/worklenz-backend/src/controllers/worklenz-controller-base.ts","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2026-25947","title":"Worklenz Boolean-Based Blind SQL Injection via Improper ORDER BY Clause Input Validation","description":"Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.","status":"published","published":"2026-02-10T17:32:56.224Z","modified":"2026-02-10T19:26:19.859Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T13:41:19.694734Z"}],"euvd":[{"id":"EUVD-2026-6752","description":"Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.","status":"published","published":"2026-02-10T17:32:56Z","modified":"2026-02-10T19:26:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:41.699812Z"}],"nvd":[{"id":"CVE-2026-25947","description":"Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.","status":"published","published":"2026-02-10T18:16:38.423Z","modified":"2026-06-17T10:25:28.417Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:05.908608Z"}],"osv":[{"id":"CVE-2026-25947","title":"Worklenz Boolean-Based Blind SQL Injection via Improper ORDER BY Clause Input Validation","description":"Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.","status":"published","published":"2026-02-10T17:32:56.224Z","modified":"2026-11-05T03:28:49.545903208Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-05T07:12:48.26887Z"},{"id":"CVE-2026-85388","title":"Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter","description":"Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947.","status":"published","published":"2026-09-03T18:54:22.561Z","modified":"2026-11-05T03:31:29.557453834Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-05T07:12:28.867005Z"}]}}