CVE-2025-15560

An authenticated attacker with minimal permissions can exploit a SQL injection vulnerability in the WorkTime server "widget" API endpoint . This flaw allows for the injection of malicious SQL queries. The consequences depend on the database backend: if the Firebird backend is used, the attacker c...