What is the CVSS score of CVE-2026-25947?

CVE-2026-25947 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Worklenz are affected by CVE-2026-25947?

A critical vulnerability (CVSS 8.8) in Worklenz project management tool poses significant risk to organizations using this platform for project coordination and data management.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25947?

Yes, a public proof-of-concept exploit is available for CVE-2026-25947. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25947?

Within 24 hours: Assess all Worklenz instances in production and document affected systems and user count. Within 7 days: Apply vendor patch to all Worklenz deployments immediately and validate patch installation across the environment. Within 30 days: Conduct security audit of Worklenz access logs to identify any unauthorized access during the vulnerability window and implement endpoint detection monitoring for exploitation indicators.

Worklenz CVE-2026-25947

HIGH

SQL Injection (CWE-89)

2026-02-10 security-advisories@github.com

SQLi Worklenz

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

PoC Detected

Feb 23, 2026 - 17:57 vuln.today

Public exploit code

Patch released

Feb 23, 2026 - 17:57 nvd

Patch available

CVE Published

Feb 10, 2026 - 18:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.

AnalysisAI

Worklenz is a project management tool. [CVSS 8.8 HIGH]

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects Worklenz. Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.

RemediationAI

A vendor patch is available — apply it immediately. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.