Nestersoft Worktime
5 CVEs affecting Nestersoft Worktime. Latest disclosed: 2026-02-19. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15559 | Critical | 9.8 | 2026-02-19 | An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the… |
CVE-2025-15560 | High | 8.8 | 2026-02-19 | An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Fireb… |
CVE-2025-15561 | High | 7.8 | 2026-02-19 | An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\SYSTEM. A malicious exe… |
CVE-2025-15562 | Medium | 6.1 | 2026-02-19 | The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attac… |
CVE-2025-15563 | Medium | 5.3 | 2026-02-19 | Any unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No authorization chec… |