Kimai: Security Vulnerabilities
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious payload, it will be mistreated while exporting to a CSV file.
CVSS Score
7.8
EPSS Score
0.005
Published
2022-04-08
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score
6.5
EPSS Score
0.001
Published
2021-12-09
kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score
8.0
EPSS Score
0.004
Published
2021-12-01
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score
4.3
EPSS Score
0.001
Published
2021-11-19
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score
4.6
EPSS Score
0.001
Published
2021-11-19
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score
4.3
EPSS Score
0.001
Published
2021-11-19
Kimai v2 before 1.1 has XSS via a timesheet description.
CVSS Score
6.1
EPSS Score
0.002
Published
2019-08-23
Page 2