CVE-2025-15560highCWE-89

CVE-2025-15560: fallo de gravedad alta en NesterSoft Inc. WorkTime (on-prem/cloud)

SQL Injection in NesterSoft WorkTime

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WorkTime

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.3%
An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can execute arbitrary SQL statements on the database backend and gain access to sensitive data.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
NesterSoft Inc. · WorkTime (on-prem/cloud)
CVEs relacionadas — NesterSoft Inc. WorkTime (on-prem/cloud)

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-15559CRITICALUnauthenticated OS Command Injection in NesterSoft WorkTimeEPSS 0.5%CVE-2025-15563MEDIUMBroken Access Control results in Denial of Service in NesterSoft WorkTimeEPSS 0.3%CVE-2025-15562MEDIUMReflected Cross-Site Scripting in NesterSoft WorkTimeEPSS 0.2%CVE-2025-15561HIGHLocal Privilege Escalation in NesterSoft WorkTimeEPSS 0.1%