What is the CVSS score of CVE-2025-15560?

CVE-2025-15560 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of MSSQL are affected by CVE-2025-15560?

A high-severity SQL injection vulnerability (CVE-2025-15560) in WorkTime server's API allows authenticated users with minimal permissions to potentially extract the entire database, including…

How to fix or mitigate CVE-2025-15560?

Within 24 hours: Identify all WorkTime deployments using Firebird backends and restrict API access via network controls or disable the widget API endpoint if non-critical. Within 7 days: Deploy WAF rules to block SQL injection patterns on the affected endpoint, conduct database access logs review for suspicious activity, and notify affected users of potential exposure. Within 30 days: Monitor vendor communication for patch availability, plan immediate deployment upon release, and conduct full database audit for unauthorized access.

MSSQL CVE-2025-15560

HIGH

SQL Injection (CWE-89)

2026-02-19 551230f0-3615-47bd-b7cc-93e92e730bbf

SQLi MSSQL Worktime

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

CVE Published

Feb 19, 2026 - 11:15 nvd

HIGH 8.8

DescriptionCVE.org

An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can execute arbitrary SQL statements on the database backend and gain access to sensitive data.

AnalysisAI

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects Worktime. An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can execute arbitrary SQL statements on the database backend and gain access to sensitive data.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.