Worklenz vulnerabilities
Published CVEs affecting Worklenz products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-25947
High · 8.8
CWE-89 Feb 10, 2026
Worklenz Boolean-Based Blind SQL Injection via Improper ORDER BY Clause Input Validation
Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.
CVE-2025-70368
Medium · 5.4
CWE-79 Jan 26, 2026
Cross-site Scripting (XSS) in Worklenz
Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project Updates feature. An attacker can submit a malicious payload in the Updates text field which is then rendered in the reporting view without proper sanitization. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field.