CVE-2019-25317

Kimai 2- persistent cross-site scripting (XSS)

5.1 MediumFix available

Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Passive

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.30%Up 0.3 points since Feb 12, 2026

What each source reports

CVE List Score used 5.1

Kimai 2- persistent cross-site scripting (XSS)

Record: CVE-2019-25317
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2019-19417 5.1

Record: EUVD-2019-19417
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-9278-6hcj-2p4j 5.1

Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions

Record: GHSA-9278-6hcj-2p4j
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

NVD 5.1

Record: CVE-2019-25317
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 5.4

Record: CVE-2019-25317
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-9278-6hcj-2p4j 5.1

Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions

Record: GHSA-9278-6hcj-2p4j
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`kimai/kimai` Packagist	before 1.1	1.1
`kimai/kimai` Packagist	before 1.1, plus listed versions 0.10.20.30.40.5 Show 8 moreShow less 0.60.6.10.70.80.8.10.91.01.0.1	1.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-25317 is a medium vulnerability (CVSS 5.1) in Kevinpapst Kimai, published February 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in kimai/kimai 1.1.