CVE-2026-44298 | Medium | 4.1 | 2026-05-08 | Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the pe… |
CVE-2026-42267 | Medium | 5.7 | 2026-05-08 | Kimai is an open-source time tracking application. From version 2.27.0 to before version 2.54.0, any ROLE_USER can create a tag with a formula string as its na… |
CVE-2026-41498 | Low | 3.3 | 2026-05-08 | Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit'… |
CVE-2026-40486 | Medium | 4.3 | 2026-04-17 | Kimai is an open-source time tracking application. In versions 2.52.0 and below, the User Preferences API endpoint (PATCH /api/users/{id}/preferences) applies… |
CVE-2026-40479 | Medium | 5.4 | 2026-04-17 | Kimai is an open-source time tracking application. In versions 1.16.3 through 2.52.0, the escapeForHtml() function in KimaiEscape.js does not escape double quo… |
CVE-2026-28685 | Medium | 6.5 | 2026-03-06 | Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/{id}" only checks the role-based view_invoice permission… |
CVE-2019-25317 | Medium | 6.4 | 2026-02-11 | Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can i… |
CVE-2026-23626 | Medium | 6.8 | 2026-01-18 | Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive… |
CVE-2023-53957 | Critical | 9.8 | 2025-12-19 | Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick… |
CVE-2024-4596 | Low | 3.7 | 2024-05-07 | A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Session Ha… |
CVE-2024-29200 | Medium | 6.8 | 2024-03-28 | Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and the API, thus return… |
CVE-2023-46245 | High | 7.2 | 2023-10-31 | Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escal… |
CVE-2020-19825 | Critical | 9.6 | 2023-02-15 | Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges. |
CVE-2021-43515 | High | 7.8 | 2022-04-08 | CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious paylo… |
CVE-2021-4033 | Medium | 6.5 | 2021-12-09 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3985 | Critical | 9.0 | 2021-12-01 | kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3963 | Medium | 4.3 | 2021-11-19 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3957 | Medium | 4.3 | 2021-11-19 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3976 | Medium | 6.5 | 2021-11-19 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2019-15481 | Medium | 6.1 | 2019-08-23 | Kimai v2 before 1.1 has XSS via a timesheet description. |