CVE-2025-15562

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-15562
The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by the attacker.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://r.sec-consult.com/worktime Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:nestersoft:worktime:*:*:*:*:cloud:*:*:*
cpe:2.3:a:nestersoft:worktime:*:*:*:*:on-premise:*:*:*
History

26 Feb 2026, 02:58

Type Values Removed Values Added
First Time Nestersoft
Nestersoft worktime
CPE cpe:2.3:a:nestersoft:worktime:*:*:*:*:on-premise:*:*:*
cpe:2.3:a:nestersoft:worktime:*:*:*:*:cloud:*:*:*
Summary
  • (es) El endpoint de la API del servidor /report/internet/urls refleja los datos recibidos en la respuesta HTML sin aplicar una codificación o filtrado adecuados. Esto permite a un atacante ejecutar JavaScript arbitrario en el navegador de la víctima si la víctima abre una URL preparada por el atacante.
References () https://r.sec-consult.com/worktime - () https://r.sec-consult.com/worktime - Third Party Advisory

20 Feb 2026, 21:19

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1

19 Feb 2026, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-19 11:15

Updated : 2026-02-26 02:58

NVD link : CVE-2025-15562

Mitre link : CVE-2025-15562

CVE.ORG link : CVE-2025-15562

JSON object : View

Products Affected

nestersoft

  • worktime
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')