Skip to content
OpenAdvisories

Vendor

NesterSoft

5 known vulnerabilities.

Products

WorkTime (on-prem/cloud) 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-15563

    Broken Access Control results in Denial of Service in NesterSoft WorkTime

    Any unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No authorization check is applied here.

    NesterSoft WorkTime (on-prem/cloud)
  • Medium 6.1
    CVE-2025-15562

    Reflected Cross-Site Scripting in NesterSoft WorkTime

    The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by th…

    NesterSoft WorkTime (on-prem/cloud)