Search
Find a vulnerability
Search criteria
11 vulnerabilities by Nestersoft
GCVE-1988-2026-0228
Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-09 13:40
VLAI
EPSS
VEX
Title
SEC Consult SA-20260218-0 :: Multiple Critical Vulnerabilities in NesterSoft WorkTime (on-prem/cloud)
Summary
SEC Consult Vulnerability Lab Security Advisory < 20260218-0 >
=======================================================================
title: Multiple Critical Vulnerabilities
product: NesterSoft WorkTime (on-prem/cloud)
vulnerable version: <= 11.8.8
fixed version: No patch available, vendor unresponsive.
CVE number: CVE-2025-15563, CVE-2025-15562, CVE-2025-15561
CVE-2025-15560, CVE-2025-15559
impact: Critical
homepage:https://www.worktime.com/
found: 2025-05-22
by: Tobias Niemann (Office Bochum)
Daniel Hirschberger
Thorger Jansen (Office Bochum)
Marius Renner (Office Berlin)
SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business
Europe | Asia
https://www.sec-consult.com
=======================================================================
Vendor description:
-------------------
"WorkTime is a green employee monitoring software with a primary focus on
monitoring employees' productivity. It is a non-invasive, transparent, safe,
and socially responsible technology. WorkTime offers a safe replacement for
every invasive function."
Source:https://www.worktime.com/employee-monitoring
Business recommendation:
------------------------
The vendor did not respond to our communication attempts anymore. It is currently
unclear, whether a patch is available. Please contact the vendor to request a
patch for the identified critical security issues.
SEC Consult highly recommends to perform a thorough security review of the
product conducted by security professionals to identify and resolve potential
further security issues.
Vulnerability overview/description:
-----------------------------------
1) Unauthenticated OS Command Injection (CVE-2025-15559)
An unauthenticated attacker can inject OS commands when calling a server API
endpoint. This allows an attacker to execute arbitrary commands on the
WorkTime server as NT Authority\SYSTEM with the highest privileges. Attackers
are able to access or manipulate sensitive data and take over the whole
server.
2) SQL Injection (MSSQL/Firebird Backend) (CVE-2025-15560)
An authenticated attacker with minimal permissions can exploit a SQL injection
in a WorkTime server API endpoint to inject SQL queries. If the Firebird
backend is used, attackers are able to retrieve all data from the database backend.
If the MSSQL backend is used the attacker can execute arbitrary SQL statements
on the database backend and gain access to sensitive data.
3) Local Privilege Escalation (CVE-2025-15561)
An attacker can exploit the update behavior of the WorkTime monitoring daemon
to elevate privileges on the local system to NT Authority\SYSTEM.
4) Reflected Cross-Site Scripting (XSS) (CVE-2025-15562)
A server API endpoint reflects received data into the HTML response without
applying proper encoding or filtering. This allows an attacker to execute
arbitrary JavaScript in the victim's browser if the victim opens a URL prepared
by the attacker.
5) Broken Access Control results in Denial of Service (CVE-2025-15563)
Any unauthenticated user can reset the WorkTime on-prem database configuration
by sending a specific HTTP request to the WorkTime server. No authorization check is
applied here.
Proof of concept:
-----------------
1) Unauthenticated OS Command Injection (CVE-2025-15559)
The server API call to generate and download the WorkTime client from the
WorkTime server is vulnerable against OS command injection in the "guid"
parameter. For this proof of concept the following OS command is injected:
--------------------------------------------------------------------------------
whoami > C:\secwashere
--------------------------------------------------------------------------------
The HTTP request is shown below:
--------------------------------------------------------------------------------
< PoC removed >
--------------------------------------------------------------------------------
The injected command is executed on the server as NT Authority\SYSTEM:
<command_injection.png>
2) SQL Injection (MSSQL/Firebird Backend) (CVE-2025-15560)
The following authenticated "widget" API endpoint is vulnerable. Minimal
permissions are required to access the server endpoint.
--------------------------------------------------------------------------------
POST /api/widget HTTP/1.1
Host: <server_hostname>:8080
Content-Type: multipart/form-data; boundary=---------------------------295635091325610060643320064167
Content-Length: [...]
-----------------------------295635091325610060643320064167
< removed >
-----------------------------295635091325610060643320064167--
--------------------------------------------------------------------------------
Note that the request requires a token value in the request body.
Any user that has access to the WorkTime server in any role has access to a
valid token. The three parameters employee, computer and department are injectable.
If the Firebird database backend is configured, the injection can be exploited
using the following sqlmap command:
--------------------------------------------------------------------------------
< PoC removed >
--------------------------------------------------------------------------------
If the MSSQL backend is used the following sqlmap command can be used
with the request from above:
--------------------------------------------------------------------------------
< PoC removed >
--------------------------------------------------------------------------------
Depending on the used MSSQL database user and the database configuration
the injection can also be exploited to execute OS commands on the server.
3) Local Privilege Escalation (CVE-2025-15561)
To exploit the vulnerability, the attacker must first create an executable that
should be executed with elevated privileges. For this proof of concept the
following C code was used.
--------------------------------------------------------------------------------
< PoC removed >
--------------------------------------------------------------------------------
It is required to add versioning information during the linking process.
Otherwise WorkTime will not execute the created binary. Any resource file can be
used:
--------------------------------------------------------------------------------
1 VERSIONINFO
FILEVERSION 1,0,0,0
PRODUCTVERSION 1,0,0,0
FILEFLAGSMASK 0x3f
FILEFLAGS 0x0
FILEOS 0x40004
FILETYPE 0x1
FILESUBTYPE 0x0
BEGIN
BLOCK "StringFileInfo"
BEGIN
BLOCK "040904b0" // Language and code page
BEGIN
VALUE "CompanyName", "Your Company"
VALUE "FileDescription", "Your Application Description"
VALUE "FileVersion", "1.0.0.0"
VALUE "InternalName", "YourApp"
VALUE "OriginalFilename", "YourApp.exe"
VALUE "ProductName", "Your Product"
VALUE "ProductVersion", "1.0.0.0"
END
END
BLOCK "VarFileInfo"
BEGIN
VALUE "Translation", 0x409, 1200
END
--------------------------------------------------------------------------------
Compile the PoC code:
--------------------------------------------------------------------------------
$ x86_64-w64-mingw32-windres resource.rc -o resource.o
$ x86_64-w64-mingw32-gcc exec.c resource.o
--------------------------------------------------------------------------------
The resulting executable must now be renamed to WTWatch.exe and be dropped
in C:\ProgramData\wta\ClientExe.
The folder is writable by Everyone:
<folder_permissions.png>
After dropping the executable, it is executed by the WorkTime monitoring daemon
as NT Authority\SYSTEM:
<priv_esc.png>
4) Reflected Cross-Site Scripting (XSS) (CVE-2025-15562)
As a proof of concept the following JavaScript payload was used:
--------------------------------------------------------------------------------
alert(document.location)
--------------------------------------------------------------------------------
The type parameter in the POST body is reflected back into the HTML response:
--------------------------------------------------------------------------------
POST /report/internet/urls HTTP/1.1
Host: <server_hostname>:8079
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: PHPSESSID=[...]; aup_accept=accept
type="><script>alert(document.cookie)</script>
--------------------------------------------------------------------------------
The injected payload is reflected back into the HTTP response without proper
encoding or filtering and the payload is executed:
<xss.png>
5) Broken Access Control results in Denial of Service (CVE-2025-15563)
An unauthenticated attacker can access the following URL to reset the
server's configured database.
< PoC URL removed >
If the attacker presses the displayed button the browser sends the following
unauthenticated HTTP request which resets the database configuration:
--------------------------------------------------------------------------------
< Poc removed >
--------------------------------------------------------------------------------
Vulnerable / tested versions:
-----------------------------
The following version has been tested which was the latest version available
at the time of the test:
* WorkTime v11.8.8
Vendor contact timeline:
------------------------
2025-07-09: Initial mail to the vendor (info () worktime com)
2025-07-23: First vendor response, requesting unencrypted advisory.
2025-07-29: Sending the advisory via email.
2025-09-29: Asking for a status update regarding any fixes or roadmap, asking
whether we should reserve CVE numbers or the vendor.
2025-09-30: Customer support answers that "Firebird for On-Premises" (CVE-2025-24975)
is fixed. They ask us which other CVEs we have identified.
2025-10-02: Replying to vendor that we submitted the advisory including all details
on 29th July and that CVE-2025-24975 has nothing to do with our advisory.
No response.
2025-11-03: Asking the vendor for a status update, informing them about our disclosure
deadline again and setting preliminary release date to 19th November.
2025-11-03: Vendor support responds to check with the technical team.
2025-11-17: Vendor responds they are actively working on it this week to analyze
the issues and report back to us within a week.
2026-02-04: No response from the vendor so far. Reserved CVE numbers, asking for
status update / fixed version numbers, informing vendor about planned
public release on 18th February.
2026-02-18: Still no response, public release of advisory.
Solution:
---------
The vendor did not respond to our communication attempts anymore. It is currently
unclear, whether a patch is available. Please contact the vendor to request a
patch for the identified critical security issues.
Workaround:
-----------
None
Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business
Europe | Asia
About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Atos business. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to wo
Severity
No CVSS data available.
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nestersoft | SEC Consult SA-20260218-0 |
Affected:
unknown
|
Relationships
analysis
GCVE-1988-2026-0228 (this record)
- related CVE-2025-15559
- related CVE-2025-15560
- related CVE-2025-15561
- related CVE-2025-15562
- related CVE-2025-15563
- related CVE-2025-24975
{
"containers": {
"cna": {
"affected": [
{
"product": "SEC Consult SA-20260218-0",
"vendor": "Nestersoft",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "SEC Consult Vulnerability Lab via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260218-0 \u003e\n=======================================================================\n title: Multiple Critical Vulnerabilities\n product: NesterSoft WorkTime (on-prem/cloud)\nvulnerable version: \u003c= 11.8.8\n fixed version: No patch available, vendor unresponsive.\n CVE number: CVE-2025-15563, CVE-2025-15562, CVE-2025-15561\n CVE-2025-15560, CVE-2025-15559\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 impact: Critical\n homepage:https://www.worktime.com/\n found: 2025-05-22\n by: Tobias Niemann (Office Bochum)\n Daniel Hirschberger\n Thorger Jansen (Office Bochum)\n Marius Renner (Office Berlin)\n SEC Consult Vulnerability Lab\n\n An integrated part of SEC Consult, an Atos business\n Europe | Asia\n\n https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"WorkTime is a green employee monitoring software with a primary focus on\nmonitoring employees\u0027 productivity. It is a non-invasive, transparent, safe,\nand socially responsible technology. WorkTime offers a safe replacement for\nevery invasive function.\"\n\nSource:https://www.worktime.com/employee-monitoring\n\n\nBusiness recommendation:\n------------------------\nThe vendor did not respond to our communication attempts anymore. It is currently\nunclear, whether a patch is available. Please contact the vendor to request a\npatch for the identified critical security issues.\n\nSEC Consult highly recommends to perform a thorough security review of the\nproduct conducted by security professionals to identify and resolve potential\nfurther security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Unauthenticated OS Command Injection (CVE-2025-15559)\nAn unauthenticated attacker can inject OS commands when calling a server API\nendpoint. This allows an attacker to execute arbitrary commands on the\nWorkTime server as NT Authority\\SYSTEM with the highest privileges. Attackers\nare able to access or manipulate sensitive data and take over the whole\nserver.\n\n2) SQL Injection (MSSQL/Firebird Backend) (CVE-2025-15560)\nAn authenticated attacker with minimal permissions can exploit a SQL injection\nin a WorkTime server API endpoint to inject SQL queries. If the Firebird\nbackend is used, attackers are able to retrieve all data from the database backend.\nIf the MSSQL backend is used the attacker can execute arbitrary SQL statements\non the database backend and gain access to sensitive data.\n\n3) Local Privilege Escalation (CVE-2025-15561)\nAn attacker can exploit the update behavior of the WorkTime monitoring daemon\nto elevate privileges on the local system to NT Authority\\SYSTEM.\n\n4) Reflected Cross-Site Scripting (XSS) (CVE-2025-15562)\nA server API endpoint reflects received data into the HTML response without\napplying proper encoding or filtering. This allows an attacker to execute\narbitrary JavaScript in the victim\u0027s browser if the victim opens a URL prepared\nby the attacker.\n\n5) Broken Access Control results in Denial of Service (CVE-2025-15563)\nAny unauthenticated user can reset the WorkTime on-prem database configuration\nby sending a specific HTTP request to the WorkTime server. No authorization check is\napplied here.\n\n\nProof of concept:\n-----------------\n1) Unauthenticated OS Command Injection (CVE-2025-15559)\nThe server API call to generate and download the WorkTime client from the\nWorkTime server is vulnerable against OS command injection in the \"guid\"\nparameter. For this proof of concept the following OS command is injected:\n--------------------------------------------------------------------------------\nwhoami \u003e C:\\secwashere\n--------------------------------------------------------------------------------\nThe HTTP request is shown below:\n--------------------------------------------------------------------------------\n\u003c PoC removed \u003e\n--------------------------------------------------------------------------------\n\nThe injected command is executed on the server as NT Authority\\SYSTEM:\n\u003ccommand_injection.png\u003e\n\n\n2) SQL Injection (MSSQL/Firebird Backend) (CVE-2025-15560)\nThe following authenticated \"widget\" API endpoint is vulnerable. Minimal\npermissions are required to access the server endpoint.\n--------------------------------------------------------------------------------\nPOST /api/widget HTTP/1.1\nHost: \u003cserver_hostname\u003e:8080\nContent-Type: multipart/form-data; boundary=---------------------------295635091325610060643320064167\nContent-Length: [...]\n-----------------------------295635091325610060643320064167\n\u003c removed \u003e\n-----------------------------295635091325610060643320064167--\n--------------------------------------------------------------------------------\n\nNote that the request requires a token value in the request body.\nAny user that has access to the WorkTime server in any role has access to a\nvalid token. The three parameters employee, computer and department are injectable.\nIf the Firebird database backend is configured, the injection can be exploited\nusing the following sqlmap command:\n--------------------------------------------------------------------------------\n\u003c PoC removed \u003e\n--------------------------------------------------------------------------------\n\nIf the MSSQL backend is used the following sqlmap command can be used\nwith the request from above:\n--------------------------------------------------------------------------------\n\u003c PoC removed \u003e\n--------------------------------------------------------------------------------\n\nDepending on the used MSSQL database user and the database configuration\nthe injection can also be exploited to execute OS commands on the server.\n\n\n3) Local Privilege Escalation (CVE-2025-15561)\nTo exploit the vulnerability, the attacker must first create an executable that\nshould be executed with elevated privileges. For this proof of concept the\nfollowing C code was used.\n--------------------------------------------------------------------------------\n\u003c PoC removed \u003e\n--------------------------------------------------------------------------------\n\nIt is required to add versioning information during the linking process.\nOtherwise WorkTime will not execute the created binary. Any resource file can be\nused:\n--------------------------------------------------------------------------------\n1 VERSIONINFO\nFILEVERSION 1,0,0,0\nPRODUCTVERSION 1,0,0,0\nFILEFLAGSMASK 0x3f\nFILEFLAGS 0x0\nFILEOS 0x40004\nFILETYPE 0x1\nFILESUBTYPE 0x0\nBEGIN\n BLOCK \"StringFileInfo\"\n BEGIN\n BLOCK \"040904b0\" // Language and code page\n BEGIN\n VALUE \"CompanyName\", \"Your Company\"\n VALUE \"FileDescription\", \"Your Application Description\"\n VALUE \"FileVersion\", \"1.0.0.0\"\n VALUE \"InternalName\", \"YourApp\"\n VALUE \"OriginalFilename\", \"YourApp.exe\"\n VALUE \"ProductName\", \"Your Product\"\n VALUE \"ProductVersion\", \"1.0.0.0\"\n END\n END\n BLOCK \"VarFileInfo\"\n BEGIN\n VALUE \"Translation\", 0x409, 1200\n END\n--------------------------------------------------------------------------------\n\nCompile the PoC code:\n--------------------------------------------------------------------------------\n$ x86_64-w64-mingw32-windres resource.rc -o resource.o\n$ x86_64-w64-mingw32-gcc exec.c resource.o\n--------------------------------------------------------------------------------\n\nThe resulting executable must now be renamed to WTWatch.exe and be dropped\nin C:\\ProgramData\\wta\\ClientExe.\n\nThe folder is writable by Everyone:\n\u003cfolder_permissions.png\u003e\n\nAfter dropping the executable, it is executed by the WorkTime monitoring daemon\nas NT Authority\\SYSTEM:\n\u003cpriv_esc.png\u003e\n\n\n4) Reflected Cross-Site Scripting (XSS) (CVE-2025-15562)\nAs a proof of concept the following JavaScript payload was used:\n--------------------------------------------------------------------------------\nalert(document.location)\n--------------------------------------------------------------------------------\n\nThe type parameter in the POST body is reflected back into the HTML response:\n--------------------------------------------------------------------------------\nPOST /report/internet/urls HTTP/1.1\nHost: \u003cserver_hostname\u003e:8079\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nCookie: PHPSESSID=[...]; aup_accept=accept\ntype=\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\n--------------------------------------------------------------------------------\nThe injected payload is reflected back into the HTTP response without proper\nencoding or filtering and the payload is executed:\n\u003cxss.png\u003e\n\n\n5) Broken Access Control results in Denial of Service (CVE-2025-15563)\nAn unauthenticated attacker can access the following URL to reset the\nserver\u0027s configured database.\n\u003c PoC URL removed \u003e\n\nIf the attacker presses the displayed button the browser sends the following\nunauthenticated HTTP request which resets the database configuration:\n--------------------------------------------------------------------------------\n\u003c Poc removed \u003e\n--------------------------------------------------------------------------------\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* WorkTime v11.8.8\n\n\nVendor contact timeline:\n------------------------\n2025-07-09: Initial mail to the vendor (info () worktime com)\n2025-07-23: First vendor response, requesting unencrypted advisory.\n2025-07-29: Sending the advisory via email.\n2025-09-29: Asking for a status update regarding any fixes or roadmap, asking\n whether we should reserve CVE numbers or the vendor.\n2025-09-30: Customer support answers that \"Firebird for On-Premises\" (CVE-2025-24975)\n is fixed. They ask us which other CVEs we have identified.\n2025-10-02: Replying to vendor that we submitted the advisory including all details\n on 29th July and that CVE-2025-24975 has nothing to do with our advisory.\n No response.\n2025-11-03: Asking the vendor for a status update, informing them about our disclosure\n deadline again and setting preliminary release date to 19th November.\n2025-11-03: Vendor support responds to check with the technical team.\n2025-11-17: Vendor responds they are actively working on it this week to analyze\n the issues and report back to us within a week.\n2026-02-04: No response from the vendor so far. Reserved CVE numbers, asking for\n status update / fixed version numbers, informing vendor about planned\n public release on 18th February.\n2026-02-18: Still no response, public release of advisory.\n\n\nSolution:\n---------\nThe vendor did not respond to our communication attempts anymore. It is currently\nunclear, whether a patch is available. Please contact the vendor to request a\npatch for the identified critical security issues.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to wo"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:40:11Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/31"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Feb/31"
},
{
"url": "https://blog.sec-consult.com"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://sec-consult.com/career/"
},
{
"url": "https://sec-consult.com/contact/"
},
{
"url": "https://sec-consult.com/vulnerability-lab/"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.sec-consult.com"
},
{
"url": "https://www.worktime.com/"
},
{
"url": "https://www.worktime.com/employee-monitoring"
},
{
"url": "https://x.com/sec_consult"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Feb/31"
],
"discovery": "EXTERNAL"
},
"title": "SEC Consult SA-20260218-0 :: Multiple Critical Vulnerabilities in NesterSoft WorkTime (on-prem/cloud)",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2025-15559",
"type": "related"
},
{
"destId": "CVE-2025-15560",
"type": "related"
},
{
"destId": "CVE-2025-15561",
"type": "related"
},
{
"destId": "CVE-2025-15562",
"type": "related"
},
{
"destId": "CVE-2025-15563",
"type": "related"
},
{
"destId": "CVE-2025-24975",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0228",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/31",
"automated": true,
"contentSha256": "d62d24712977ac958ebaeb4265f410481e4b5d447d9dd58f15c59a9e39a78d89",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/31",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-02-18T11:52:03Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0228"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:57:43Z",
"dateUpdated": "2026-09-09T13:40:11Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0228"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15563 (GCVE-0-2025-15563)
Vulnerability from nvd – Published: 2026-02-19 11:01 – Updated: 2026-02-20 20:35
VLAI
EPSS
VEX
Title
Broken Access Control results in Denial of Service in NesterSoft WorkTime
Summary
Any unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No authorization check is applied here.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-20 20:34 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://r.sec-consult.com/worktime | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NesterSoft Inc. | WorkTime (on-prem/cloud) |
Affected:
<= 11.8.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-15563",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-20T20:34:46.208230Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-20T20:35:11.872Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WorkTime (on-prem/cloud)",
"vendor": "NesterSoft Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c= 11.8.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tobias Niemann, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Daniel Hirschberger, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Thorger Jansen, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Marius Renner, SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eAny unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No authorization check is applied here.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Any unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No authorization check is applied here."
}
],
"impacts": [
{
"capecId": "CAPEC-166",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-166 Force the System to Reset Values"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-19T11:01:56.524Z",
"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"shortName": "SEC-VLab"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://r.sec-consult.com/worktime"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues.\u003cbr\u003e"
}
],
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Broken Access Control results in Denial of Service in NesterSoft WorkTime",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"assignerShortName": "SEC-VLab",
"cveId": "CVE-2025-15563",
"datePublished": "2026-02-19T11:01:56.524Z",
"dateReserved": "2026-02-04T07:44:38.507Z",
"dateUpdated": "2026-02-20T20:35:11.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15562 (GCVE-0-2025-15562)
Vulnerability from nvd – Published: 2026-02-19 10:54 – Updated: 2026-02-20 20:34
VLAI
EPSS
VEX
Title
Reflected Cross-Site Scripting in NesterSoft WorkTime
Summary
The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by the attacker.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-20 20:33 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://r.sec-consult.com/worktime | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NesterSoft Inc. | WorkTime (on-prem/cloud) |
Affected:
<= 11.8.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-15562",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-20T20:33:44.840500Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-20T20:34:10.495Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WorkTime (on-prem/cloud)",
"vendor": "NesterSoft Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c= 11.8.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tobias Niemann, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Daniel Hirschberger, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Thorger Jansen, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Marius Renner, SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe server API endpoint\u0026nbsp;\u003cspan style=\"background-color: rgba(255, 255, 255, 0.5);\"\u003e/report/internet/urls\u003c/span\u003e reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim\u0027s browser if the victim opens a URL prepared by the attacker.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "The server API endpoint\u00a0/report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim\u0027s browser if the victim opens a URL prepared by the attacker."
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-591 Reflected XSS"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-19T10:54:52.516Z",
"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"shortName": "SEC-VLab"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://r.sec-consult.com/worktime"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues.\u003cbr\u003e"
}
],
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Reflected Cross-Site Scripting in NesterSoft WorkTime",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"assignerShortName": "SEC-VLab",
"cveId": "CVE-2025-15562",
"datePublished": "2026-02-19T10:54:52.516Z",
"dateReserved": "2026-02-04T07:44:36.442Z",
"dateUpdated": "2026-02-20T20:34:10.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15561 (GCVE-0-2025-15561)
Vulnerability from nvd – Published: 2026-02-19 10:53 – Updated: 2026-02-23 18:26
VLAI
EPSS
VEX
Title
Local Privilege Escalation in NesterSoft WorkTime
Summary
An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\SYSTEM. A malicious executable must be named WTWatch.exe and dropped in the C:\ProgramData\wta\ClientExe directory, which is writable by "Everyone". The executable will then be run by the WorkTime monitoring daemon.
Severity
7.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-23 18:26 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://r.sec-consult.com/worktime | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NesterSoft Inc. | WorkTime (on-prem/cloud) |
Affected:
<= 11.8.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-15561",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-23T18:26:10.960311Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-23T18:26:47.903Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WorkTime (on-prem/cloud)",
"vendor": "NesterSoft Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c= 11.8.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tobias Niemann, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Daniel Hirschberger, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Thorger Jansen, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Marius Renner, SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\\SYSTEM. A malicious executable must be named\u0026nbsp; WTWatch.exe and dropped in the C:\\ProgramData\\wta\\ClientExe directory, which is writable by \"Everyone\". The executable will then be run by the WorkTime monitoring daemon.\u003cbr\u003e\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\\SYSTEM. A malicious executable must be named\u00a0 WTWatch.exe and dropped in the C:\\ProgramData\\wta\\ClientExe directory, which is writable by \"Everyone\". The executable will then be run by the WorkTime monitoring daemon."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-19T10:53:18.501Z",
"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"shortName": "SEC-VLab"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://r.sec-consult.com/worktime"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues.\u003cbr\u003e"
}
],
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Local Privilege Escalation in NesterSoft WorkTime",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"assignerShortName": "SEC-VLab",
"cveId": "CVE-2025-15561",
"datePublished": "2026-02-19T10:53:18.501Z",
"dateReserved": "2026-02-04T07:44:34.747Z",
"dateUpdated": "2026-02-23T18:26:47.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15560 (GCVE-0-2025-15560)
Vulnerability from nvd – Published: 2026-02-19 10:48 – Updated: 2026-02-23 18:29
VLAI
EPSS
VEX
Title
SQL Injection in NesterSoft WorkTime
Summary
An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can execute arbitrary SQL statements on the database backend and gain access to sensitive data.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-23 18:28 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://r.sec-consult.com/worktime | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NesterSoft Inc. | WorkTime (on-prem/cloud) |
Affected:
<= 11.8.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-15560",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-23T18:28:09.988278Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-23T18:29:08.299Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WorkTime (on-prem/cloud)",
"vendor": "NesterSoft Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c= 11.8.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tobias Niemann, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Daniel Hirschberger, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Thorger Jansen, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Marius Renner, SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server \"widget\" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can execute arbitrary SQL statements on the database backend and gain access to sensitive data.\u003cbr\u003e"
}
],
"value": "An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server \"widget\" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can execute arbitrary SQL statements on the database backend and gain access to sensitive data."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-19T10:48:43.486Z",
"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"shortName": "SEC-VLab"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://r.sec-consult.com/worktime"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues.\u003cbr\u003e"
}
],
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SQL Injection in NesterSoft WorkTime",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"assignerShortName": "SEC-VLab",
"cveId": "CVE-2025-15560",
"datePublished": "2026-02-19T10:48:43.486Z",
"dateReserved": "2026-02-04T07:44:30.139Z",
"dateUpdated": "2026-02-23T18:29:08.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15559 (GCVE-0-2025-15559)
Vulnerability from nvd – Published: 2026-02-19 10:45 – Updated: 2026-02-23 18:30
VLAI
EPSS
VEX
Title
Unauthenticated OS Command Injection in NesterSoft WorkTime
Summary
An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-23 18:30 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://r.sec-consult.com/worktime | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NesterSoft Inc. | WorkTime (on-prem/cloud) |
Affected:
<= 11.8.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-15559",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-23T18:30:20.488085Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-23T18:30:52.019Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WorkTime (on-prem/cloud)",
"vendor": "NesterSoft Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c= 11.8.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tobias Niemann, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Daniel Hirschberger, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Thorger Jansen, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Marius Renner, SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the \u201cguid\u201d parameter.\u0026nbsp;\u003c/span\u003eThis allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.\u003cbr\u003e"
}
],
"value": "An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the \u201cguid\u201d parameter.\u00a0This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-19T10:45:34.943Z",
"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"shortName": "SEC-VLab"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://r.sec-consult.com/worktime"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues.\u003cbr\u003e"
}
],
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated OS Command Injection in NesterSoft WorkTime",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"assignerShortName": "SEC-VLab",
"cveId": "CVE-2025-15559",
"datePublished": "2026-02-19T10:45:34.943Z",
"dateReserved": "2026-02-04T07:44:28.922Z",
"dateUpdated": "2026-02-23T18:30:52.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15563 (GCVE-0-2025-15563)
Vulnerability from cvelistv5 – Published: 2026-02-19 11:01 – Updated: 2026-02-20 20:35
VLAI
EPSS
VEX
Title
Broken Access Control results in Denial of Service in NesterSoft WorkTime
Summary
Any unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No authorization check is applied here.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-20 20:34 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://r.sec-consult.com/worktime | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NesterSoft Inc. | WorkTime (on-prem/cloud) |
Affected:
<= 11.8.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-15563",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-20T20:34:46.208230Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-20T20:35:11.872Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WorkTime (on-prem/cloud)",
"vendor": "NesterSoft Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c= 11.8.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tobias Niemann, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Daniel Hirschberger, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Thorger Jansen, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Marius Renner, SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eAny unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No authorization check is applied here.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Any unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No authorization check is applied here."
}
],
"impacts": [
{
"capecId": "CAPEC-166",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-166 Force the System to Reset Values"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-19T11:01:56.524Z",
"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"shortName": "SEC-VLab"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://r.sec-consult.com/worktime"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues.\u003cbr\u003e"
}
],
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Broken Access Control results in Denial of Service in NesterSoft WorkTime",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"assignerShortName": "SEC-VLab",
"cveId": "CVE-2025-15563",
"datePublished": "2026-02-19T11:01:56.524Z",
"dateReserved": "2026-02-04T07:44:38.507Z",
"dateUpdated": "2026-02-20T20:35:11.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15562 (GCVE-0-2025-15562)
Vulnerability from cvelistv5 – Published: 2026-02-19 10:54 – Updated: 2026-02-20 20:34
VLAI
EPSS
VEX
Title
Reflected Cross-Site Scripting in NesterSoft WorkTime
Summary
The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by the attacker.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-20 20:33 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://r.sec-consult.com/worktime | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NesterSoft Inc. | WorkTime (on-prem/cloud) |
Affected:
<= 11.8.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-15562",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-20T20:33:44.840500Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-20T20:34:10.495Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WorkTime (on-prem/cloud)",
"vendor": "NesterSoft Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c= 11.8.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tobias Niemann, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Daniel Hirschberger, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Thorger Jansen, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Marius Renner, SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe server API endpoint\u0026nbsp;\u003cspan style=\"background-color: rgba(255, 255, 255, 0.5);\"\u003e/report/internet/urls\u003c/span\u003e reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim\u0027s browser if the victim opens a URL prepared by the attacker.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "The server API endpoint\u00a0/report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim\u0027s browser if the victim opens a URL prepared by the attacker."
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-591 Reflected XSS"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-19T10:54:52.516Z",
"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"shortName": "SEC-VLab"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://r.sec-consult.com/worktime"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues.\u003cbr\u003e"
}
],
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Reflected Cross-Site Scripting in NesterSoft WorkTime",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"assignerShortName": "SEC-VLab",
"cveId": "CVE-2025-15562",
"datePublished": "2026-02-19T10:54:52.516Z",
"dateReserved": "2026-02-04T07:44:36.442Z",
"dateUpdated": "2026-02-20T20:34:10.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15561 (GCVE-0-2025-15561)
Vulnerability from cvelistv5 – Published: 2026-02-19 10:53 – Updated: 2026-02-23 18:26
VLAI
EPSS
VEX
Title
Local Privilege Escalation in NesterSoft WorkTime
Summary
An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\SYSTEM. A malicious executable must be named WTWatch.exe and dropped in the C:\ProgramData\wta\ClientExe directory, which is writable by "Everyone". The executable will then be run by the WorkTime monitoring daemon.
Severity
7.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-23 18:26 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://r.sec-consult.com/worktime | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NesterSoft Inc. | WorkTime (on-prem/cloud) |
Affected:
<= 11.8.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-15561",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-23T18:26:10.960311Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-23T18:26:47.903Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WorkTime (on-prem/cloud)",
"vendor": "NesterSoft Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c= 11.8.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tobias Niemann, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Daniel Hirschberger, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Thorger Jansen, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Marius Renner, SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\\SYSTEM. A malicious executable must be named\u0026nbsp; WTWatch.exe and dropped in the C:\\ProgramData\\wta\\ClientExe directory, which is writable by \"Everyone\". The executable will then be run by the WorkTime monitoring daemon.\u003cbr\u003e\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\\SYSTEM. A malicious executable must be named\u00a0 WTWatch.exe and dropped in the C:\\ProgramData\\wta\\ClientExe directory, which is writable by \"Everyone\". The executable will then be run by the WorkTime monitoring daemon."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-19T10:53:18.501Z",
"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"shortName": "SEC-VLab"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://r.sec-consult.com/worktime"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues.\u003cbr\u003e"
}
],
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Local Privilege Escalation in NesterSoft WorkTime",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"assignerShortName": "SEC-VLab",
"cveId": "CVE-2025-15561",
"datePublished": "2026-02-19T10:53:18.501Z",
"dateReserved": "2026-02-04T07:44:34.747Z",
"dateUpdated": "2026-02-23T18:26:47.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15560 (GCVE-0-2025-15560)
Vulnerability from cvelistv5 – Published: 2026-02-19 10:48 – Updated: 2026-02-23 18:29
VLAI
EPSS
VEX
Title
SQL Injection in NesterSoft WorkTime
Summary
An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can execute arbitrary SQL statements on the database backend and gain access to sensitive data.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-23 18:28 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://r.sec-consult.com/worktime | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NesterSoft Inc. | WorkTime (on-prem/cloud) |
Affected:
<= 11.8.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-15560",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-23T18:28:09.988278Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-23T18:29:08.299Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WorkTime (on-prem/cloud)",
"vendor": "NesterSoft Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c= 11.8.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tobias Niemann, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Daniel Hirschberger, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Thorger Jansen, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Marius Renner, SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server \"widget\" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can execute arbitrary SQL statements on the database backend and gain access to sensitive data.\u003cbr\u003e"
}
],
"value": "An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server \"widget\" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can execute arbitrary SQL statements on the database backend and gain access to sensitive data."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-19T10:48:43.486Z",
"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"shortName": "SEC-VLab"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://r.sec-consult.com/worktime"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues.\u003cbr\u003e"
}
],
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SQL Injection in NesterSoft WorkTime",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"assignerShortName": "SEC-VLab",
"cveId": "CVE-2025-15560",
"datePublished": "2026-02-19T10:48:43.486Z",
"dateReserved": "2026-02-04T07:44:30.139Z",
"dateUpdated": "2026-02-23T18:29:08.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15559 (GCVE-0-2025-15559)
Vulnerability from cvelistv5 – Published: 2026-02-19 10:45 – Updated: 2026-02-23 18:30
VLAI
EPSS
VEX
Title
Unauthenticated OS Command Injection in NesterSoft WorkTime
Summary
An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-23 18:30 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://r.sec-consult.com/worktime | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NesterSoft Inc. | WorkTime (on-prem/cloud) |
Affected:
<= 11.8.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-15559",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-23T18:30:20.488085Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-23T18:30:52.019Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WorkTime (on-prem/cloud)",
"vendor": "NesterSoft Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c= 11.8.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tobias Niemann, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Daniel Hirschberger, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Thorger Jansen, SEC Consult Vulnerability Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Marius Renner, SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the \u201cguid\u201d parameter.\u0026nbsp;\u003c/span\u003eThis allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.\u003cbr\u003e"
}
],
"value": "An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the \u201cguid\u201d parameter.\u00a0This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-19T10:45:34.943Z",
"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"shortName": "SEC-VLab"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://r.sec-consult.com/worktime"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues.\u003cbr\u003e"
}
],
"value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated OS Command Injection in NesterSoft WorkTime",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
"assignerShortName": "SEC-VLab",
"cveId": "CVE-2025-15559",
"datePublished": "2026-02-19T10:45:34.943Z",
"dateReserved": "2026-02-04T07:44:28.922Z",
"dateUpdated": "2026-02-23T18:30:52.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}