Filtered by vendor Kimai Subscriptions
Total 9 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-46245 1 Kimai 1 Kimai 2024-01-12 7.2 High
Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML rendering functionalities. Version 2.1.0 enables security measures for custom Twig templates.
CVE-2020-19825 1 Kimai 1 Kimai 2023-02-23 9.6 Critical
Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges.
CVE-2021-43515 1 Kimai 1 Kimai 2022-04-14 7.8 High
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious payload, it will be mistreated while exporting to a CSV file.
CVE-2021-4033 1 Kimai 1 Kimai 2 2021-12-13 6.5 Medium
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3985 1 Kimai 1 Kimai2 2021-12-02 9.0 Critical
kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-3957 1 Kimai 1 Kimai 2 2021-11-23 4.3 Medium
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3976 1 Kimai 1 Kimai 2 2021-11-23 6.5 Medium
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3963 1 Kimai 1 Kimai 2 2021-11-23 4.3 Medium
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2019-15481 1 Kimai 1 Kimai 2 2019-08-26 N/A
Kimai v2 before 1.1 has XSS via a timesheet description.