CVE-2025-15559

CRITICAL
2026-02-19 551230f0-3615-47bd-b7cc-93e92e730bbf
9.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 22:03 vuln.today
CVE Published
Feb 19, 2026 - 11:15 nvd
CRITICAL 9.8

Tags

Command Injection Worktime

Description

An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.

Analysis

Unauthenticated OS command injection in NesterSoft WorkTime via report generation API. Allows executing arbitrary commands.

Technical Context

CWE-78 in report download API.

Affected Products

['NesterSoft WorkTime']

Remediation

Apply vendor patch.

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: +0.2
CVSS: +49
POC: 0

Share

CVE-2025-15559 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy