CVE-2025-15560CWE-89

SQL Injection in NesterSoft WorkTime

High · published February 19, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can execute arbitrary SQL statements on the database backend and gain access to sensitive data.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00292 · 20.6th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-02-19T10:48Z
EPSS history
Timeline
  • 19 FEB 10:48Z
    SQL Injection in NesterSoft WorkTime
    cvelistv5