SQL Injection in Nestersoft Worktime
CVE-2025-15560
An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can execute arbitrary SQL statements on the database backend and gain access to sensitive data.
Vulnerability class: SQL Injection
EPSS: 0.003 (16.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Nestersoft Worktime
- Nestersoft Inc. Worktime (On-prem/cloud) — versions <= 11.8.8
Weakness classification (CWE)
References
- 551230f0-3615-47bd-b7cc-93e92e730bbf (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2025-15560?
- CVE-2025-15560 is a high-severity vulnerability in Nestersoft Worktime, classified under SQL Injection. CVSS score: 8.8/10. Published 2026-02-19.
- How severe is CVE-2025-15560?
- High severity. CVSS v3 base score is 8.8 out of 10.