CVE-2025-15559: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on t...

NesterSoft WorkTime security vulnerability

NesterSoft WorkTime is a project tracking software developed by the Canadian company NesterSoft. NesterSoft WorkTime has a security vulnerability, which stems from an SQL injection vulnerability in the widget API endpoint. This vulnerability could lead to data leaks or the execution of arbitrary...

PT-2026-20798

Name of the Vulnerable Software and Affected Versions NesterSoft WorkTime affected versions not specified Description An unauthenticated attacker can inject OS commands when calling a server API endpoint. The server API call to generate and download the WorkTime client is vulnerable through the...

PT-2026-20799

Name of the Vulnerable Software and Affected Versions WorkTime affected versions not specified Description An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server ''widget'' API endpoint to inject SQL queries. If the Firebird backend is used, attacker...

WorkTime 10.20 Build 4967 - Unquoted Service Path

Exploit Title: WorkTime 10.20 Build 4967 - Unquoted Service Path Discovery by: Yehia Elghaly Date: 30-12-2021 Vendor Homepage: https://www.worktime.com/ Software Link: https://www.worktime.com/download/worktimecorporate.exe Tested Version: 10.20 Build Build 4967 Vulnerability Type: Unquoted Servi...

Worktime 10.20 Build 4967 Unquoted Service Path Vulnerability

Exploit Title: WorkTime 10.20 Build Build 4967 Unquoted Service Path Discovery by: Yehia Elghaly Vendor Homepage: https://www.worktime.com/ Software Link: https://www.worktime.com/download/worktimecorporate.exe Tested Version: 10.20 Build Build 4967 Vulnerability Type: Unquoted Service Path Teste...

Worktime 10.20 Build 4967 DLL Hijacking Vulnerability

/ Description: A vulnerability exists in windows that allows other applications dynamic link libraries to execute malicious code without the users consent, in the privelage context of the targeted application. Exploit Title: Worktime 10.20 Build 4967 DLL Hijacking Exploit Date: 15/01/2022 Author:...

Worktime 10.20 Build 4967 Unquoted Service Path

Exploit Title: WorkTime 10.20 Build Build 4967 Unquoted Service Path Discovery by: Yehia Elghaly Date: 30-12-2021 Vendor Homepage: https://www.worktime.com/ Software Link: https://www.worktime.com/download/worktimecorporate.exe Tested Version: 10.20 Build Build 4967 Vulnerability Type: Unquoted...

Worktime 10.20 Build 4967 DLL Hijacking

/ Description: A vulnerability exists in windows that allows other applications dynamic link libraries to execute malicious code without the users consent, in the privelage context of the targeted application. Exploit Title: Worktime 10.20 Build 4967 DLL Hijacking Exploit Date: 15/01/2022 Author:...