Skip to content
OpenAdvisories

Vendor

NesterSoft

5 known vulnerabilities.

NesterSoft at a glance

Last 12 months
5
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 5 vulnerabilities, 1 critical March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202651
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

WorkTime (on-prem/cloud) 5
All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Medium 5.3
    CVE-2025-15563

    Broken Access Control results in Denial of Service in NesterSoft WorkTime

    Any unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No authorization check is applied here.

    NesterSoft WorkTime (on-prem/cloud)
  • Medium 6.1
    CVE-2025-15562

    Reflected Cross-Site Scripting in NesterSoft WorkTime

    The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by th…

    NesterSoft WorkTime (on-prem/cloud)
  • High 7.8
    CVE-2025-15561

    Local Privilege Escalation in NesterSoft WorkTime

    An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\SYSTEM. A malicious executable must be named  WTWatch.exe and dropped in the C:\ProgramData\wta\ClientExe directory, which …

    NesterSoft WorkTime (on-prem/cloud)
  • High 8.8
    CVE-2025-15560

    SQL Injection in NesterSoft WorkTime

    An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL…

    NesterSoft WorkTime (on-prem/cloud)
  • Critical 9.8
    CVE-2025-15559

    Unauthenticated OS Command Injection in NesterSoft WorkTime

    An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attac…

    NesterSoft WorkTime (on-prem/cloud)