SQL Injection in NesterSoft WorkTime
Priority MEDIUM 40CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-89.
Summary
An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can execute arbitrary SQL statements on the database backend and gain access to sensitive data.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00292 21st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NesterSoft Inc. | WorkTime (on-prem/cloud) | up to 11.8.8 | — | No fix listed | CNA |
- WorkTime (on-prem/cloud) VendorNesterSoft Inc. Affected up to 11.8.8 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nestersoft:worktime:*:*:*:*:cloud:*:*:* | up to 11.8.8 | Vulnerable | NesterSoft Inc. |
| cpe:2.3:a:nestersoft:worktime:*:*:*:*:on-premise:*:*:* | up to 11.8.8 | Vulnerable | NesterSoft Inc. |
- cpe:2.3:a:nestersoft:worktime:*:*:*:*:cloud:*:*:* Versions up to 11.8.8 Vulnerable ·NesterSoft Inc.
- cpe:2.3:a:nestersoft:worktime:*:*:*:*:on-premise:*:*:* Versions up to 11.8.8 Vulnerable ·NesterSoft Inc.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-15560
- 2026-10-03 Alias added: GHSA-vq94-wmm9-737m
References
Advisory 1
More NesterSoft Inc. Worktime vulnerabilities
- TI-2025-14198 Unauthenticated OS Command Injection in NesterSoft WorkTime CVSS 3.1CRITICAL 9.8
- TI-2025-14200 Local Privilege Escalation in NesterSoft WorkTime CVSS 3.1HIGH 7.8
- TI-2025-14202 Broken Access Control results in Denial of Service in NesterSoft WorkTime CVSS 3.1MEDIUM 5.3
- TI-2025-14201 Reflected Cross-Site Scripting in NesterSoft WorkTime CVSS 3.1MEDIUM 6.1
Sources
- CVE-2025-15560 · CVE Program
- CVE-2025-15560 · NVD
- FIRST EPSS
- GHSA-vq94-wmm9-737m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences