Back to Database
Status published
Unknown
CVE-2025-15563
Broken Access Control results in Denial of Service in NesterSoft WorkTime
Vulnerability Description
Any unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No authorization check is applied here.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15563
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Tobias Niemann, SEC Consult Vulnerability Lab
- Daniel Hirschberger, SEC Consult Vulnerability Lab
- Thorger Jansen, SEC Consult Vulnerability Lab
- Marius Renner, SEC Consult Vulnerability Lab
References
More from NesterSoft Inc.
View All →CVE-2025-15562
Reflected Cross-Site Scripting in NesterSoft WorkTime
Unknown
0
CVE-2025-15561
Local Privilege Escalation in NesterSoft WorkTime
Unknown
0
CVE-2025-15560
SQL Injection in NesterSoft WorkTime
Unknown
0
CVE-2025-15559
Unauthenticated OS Command Injection in NesterSoft WorkTime
Unknown
0
Affected Vendor
NesterSoft Inc.
View all reports →Affected Software
WorkTime (on-prem/cloud)
Vulnerable Versions:
<= 11.8.8
Timeline
Official Publish:
February 19th, 2026
Last Modified:
February 20th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
No vector data available