Approved changes feed: RSS · Atom
cpe:2.3:a:worklenz:worklenz:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Worklenz (6aa9f934-12a2-53e8-ac08-d256dffd77db) |
|---|---|
| Product | Worklenz (e479c640-f7fe-5662-b237-0473987d7f75) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/worklenz/worklenz |
purl2cpe | 2026-07-28 16:40:49.429646 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-85389 |
vulnerable | 2026-09-16 04:33:08.073804 |
Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints
MEDIUM (6.5)
Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project insights belonging to other organizations.
Published: 2026-09-03T18:54:23.204Z
Updated: 2026-09-14T13:50:52.023Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25947 |
vulnerable | 2026-06-08 07:53:20.634311 |
Worklenz Boolean-Based Blind SQL Injection via Improper ORDER BY Clause Input Validation
HIGH (8.8)
Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.
Published: 2026-02-10T17:32:56.224Z
Updated: 2026-02-10T19:26:19.859Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.