CVE-2025-10640

Name of the Vulnerable Software and Affected Versions WorkExaminer versions (affected versions not specified)

Description An unauthenticated attacker gaining access to TCP port 12306 of the WorkExaminer server can bypass the login prompt due to missing server-side authentication checks. This allows administrative access to the WorkExaminer server and all sensitive monitoring data, including monitored screenshots and keystrokes of all users. The WorkExaminer Professional console, used for administrative access, utilizes a custom protocol to call a stored procedure on the MSSQL database. The server does not validate the return value of this call, relying instead on client-side validation, which can be circumvented.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.