TI-2026-20974 CVE-2026-25947
Worklenz Boolean-Based Blind SQL Injection via Improper ORDER BY Clause Input Validation
Priority HIGH 73
Worklenz is a project management tool.
Worklenz
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
Worklenz records in CISA KEVNo Worklenz vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
4 records
TI-2026-58596 CVE-2026-85388 · GHSA-j38m-6g5x-xxgg
Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter
Priority HIGH 72
Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses.
TI-2025-43109 CVE-2025-70368 · GHSA-rxx2-x5v3-hv94
Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the…
Priority MEDIUM 58
Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project Updates feature.
TI-2026-58597 CVE-2026-85389 · GHSA-3hvp-rq7g-qf5w
Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints
Priority LOW 32
Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data.