CVE-2025-15562 - Vulnerability Details - OpenCVE

The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by the attacker.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Nestersoft	Worktime

No data.

No data.

References

Link	Providers
https://r.sec-consult.com/worktime

History

Fri, 20 Feb 2026 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 20 Feb 2026 10:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Nestersoft Nestersoft worktime
Vendors & Products		Nestersoft Nestersoft worktime

Thu, 19 Feb 2026 11:15:00 +0000

Type	Values Removed	Values Added
Description		The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by the attacker.
Title		Reflected Cross-Site Scripting in NesterSoft WorkTime
Weaknesses		CWE-79
References		https://r.sec-consult.com/worktime

MITRE

Status: PUBLISHED

Assigner: SEC-VLab

Published: 2026-02-19T10:54:52.516Z

Updated: 2026-02-20T20:34:10.495Z

Reserved: 2026-02-04T07:44:36.442Z

Link: CVE-2025-15562

Vulnrichment

Updated: 2026-02-20T20:34:05.282Z

NVD

Status : Undergoing Analysis

Published: 2026-02-19T11:15:56.860

Modified: 2026-02-20T21:19:24.343

Link: CVE-2025-15562

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15562", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "state": "PUBLISHED", "assignerShortName": "SEC-VLab", "dateReserved": "2026-02-04T07:44:36.442Z", "datePublished": "2026-02-19T10:54:52.516Z", "dateUpdated": "2026-02-20T20:34:10.495Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "WorkTime (on-prem/cloud)", "vendor": "NesterSoft Inc.", "versions": [{"status": "affected", "version": "<= 11.8.8"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Tobias Niemann, SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Daniel Hirschberger, SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Thorger Jansen, SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Marius Renner, SEC Consult Vulnerability Lab"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p></p><p>The server API endpoint <span style=\"background-color: rgba(255, 255, 255, 0.5);\">/report/internet/urls</span> reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by the attacker.</p><p></p>"}], "value": "The server API endpoint\u00a0/report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by the attacker."}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2026-02-19T10:54:52.516Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://r.sec-consult.com/worktime"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues.<br>"}], "value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues."}], "source": {"discovery": "EXTERNAL"}, "title": "Reflected Cross-Site Scripting in NesterSoft WorkTime", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T20:33:44.840500Z", "id": "CVE-2025-15562", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T20:34:10.495Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Reflected Cross-Site Scripting in NesterSoft WorkTime", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Tobias Niemann, SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Daniel Hirschberger, SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Thorger Jansen, SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Marius Renner, SEC Consult Vulnerability Lab"}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "affected": [{"vendor": "NesterSoft Inc.", "product": "WorkTime (on-prem/cloud)", "versions": [{"status": "affected", "version": "<= 11.8.8"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues.", "supportingMedia": [{"type": "text/html", "value": "The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues.<br>", "base64": false}]}], "references": [{"url": "https://r.sec-consult.com/worktime", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "The server API endpoint\u00a0/report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by the attacker.", "supportingMedia": [{"type": "text/html", "value": "<p></p><p>The server API endpoint <span style=\"background-color: rgba(255, 255, 255, 0.5);\">/report/internet/urls</span> reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by the attacker.</p><p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2026-02-19T10:54:52.516Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-15562", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T20:33:44.840500Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-02-20T20:34:05.282Z"}}]}, "cveMetadata": {"cveId": "CVE-2025-15562", "state": "PUBLISHED", "dateUpdated": "2026-02-19T10:54:52.516Z", "dateReserved": "2026-02-04T07:44:36.442Z", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "datePublished": "2026-02-19T10:54:52.516Z", "assignerShortName": "SEC-VLab"}, "dataVersion": "5.2"}