Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
When hours are entered in time@work, version 7.0.5, it performs a query to display the projects assigned to the user. If the query URL is copied and opened in a new browser window, the ‘IDClient’ parameter is vulnerable to a blind authenticated SQL injection. If the request is made with the TWAdmin user with the sysadmin role enabled, exploiting the vulnerability will allow commands to be executed on the system; if the user does not belong to the sysadmin role, they will still be able to query data from the database.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
⚠️#INCIBEaviso | Inyección SQL en time@work de #systemswork #CVE CVE-2025-59920 https://www.incibe.es/incibe-cert/alerta-temprana/avisos/inyeccion-sql-en-timework-de-systemswork #AvisosDeSeguridad #TI https://t.co/2AQzkJZZce
Post summary
INCIBE alerts that the time@work system of systemswork contains a SQL injection flaw (CVE‑2025‑59920), with no evidence of exploitation or mitigation yet.
CVE-2025-59920 When hours are entered in time@work, version 7.0.5, it performs a query to display the projects assigned to the user. If the query URL is copied and opened in a new b… https://www.cve.org/CVERecord?id=CVE-2025-59920
Post summary
CVE-2025-59920 is a vulnerability in time@work 7.0.5 that allows a crafted query URL to expose the projects assigned to a user; the text does not provide evidence of exploitation, PoC, or a patch.