CVE-2025-15562
Awaiting Analysis Awaiting Analysis - Queue

Reflected XSS in /report/internet/urls API Endpoint Enables Code Execution

Publication date: 2026-02-19

Last updated on: 2026-02-26

Assigner: SEC Consult Vulnerability Lab

Description
The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by the attacker.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-19
Last Modified
2026-02-26
Generated
2026-07-06
AI Q&A
2026-02-19
EPSS Evaluated
2026-07-05
NVD
CVE-2025-15562

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nestersoft worktime to 11.8.8 (inc)
nestersoft worktime to 11.8.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the server API endpoint /report/internet/urls, which reflects received data into the HTML response without proper encoding or filtering.

Because of this, an attacker can craft a malicious URL that, when opened by a victim, allows the attacker to execute arbitrary JavaScript code in the victim's browser.

Impact Analysis

This vulnerability can lead to cross-site scripting (XSS) attacks, where an attacker can run malicious scripts in the context of the victim's browser.

  • Stealing sensitive information such as cookies or session tokens.
  • Performing actions on behalf of the victim without their consent.
  • Potentially redirecting the victim to malicious websites.
Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15562. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart