Skip to content
Kimai vulnerabilities
Newest
-
kimai
Kimai before 2.65.0 Authorization Bypass via API Timesheet
CVE-2026-84808
5.3 Medium
-
kimai
Kimai before 2.65.0 Authentication Bypass via Team Creation
CVE-2026-84807
5.3 Medium
-
kimai
Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints
CVE-2026-84806
5.3 Medium
-
kimai
Kimai 2.61.0 before 2.63.0 Authentication Bypass via API
CVE-2026-84805
5.3 Medium
-
kimai
Kimai before 2.65.0 Authorization Bypass via Team Activity API
CVE-2026-84804
5.3 Medium
-
kimai
Kimai before 2.63.0 Team Membership Removal via API
CVE-2026-80195
8.7 High
-
kimai
Kimai before 2.64.0 Missing Authorization via ProjectViewController export
CVE-2026-80194
8.7 High
-
kimai
Kimai before 2.62.0 Authorization Bypass via QuickEntry
CVE-2026-80193
8.7 High
-
kimai
Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access
CVE-2026-52828
Fix available
5.3 Medium
-
kimai
Kimai: Two-factor authentication bypass on the Kimai API
CVE-2026-52827
Fix available
7.1 High
-
kimai
Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation
CVE-2026-52826
Fix available
5.3 Medium
-
kimai
Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility
CVE-2026-52825
Fix available
5.3 Medium
-
kimai
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
CVE-2026-52824
Public exploitFix available
9.1 Critical
-
kimai
Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes
CVE-2026-52823
Fix available
5.3 Medium
-
kimai
Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation
CVE-2026-52822
Fix available
5.3 Medium
-
kimai
Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects
CVE-2026-52821
Fix available
5.3 Medium
-
kimai
Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass
CVE-2026-52820
Fix available
5.3 Medium
-
kimai
Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target
CVE-2026-52819
Fix available
6.3 Medium
-
kimai
Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes
CVE-2026-49992
Fix available
6.3 Medium
-
kimai
Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs
CVE-2026-49865
Fix available
5.3 Medium
-
kimai
Kimai before 2.57.0 Improper Authorization via Favorite Endpoints
CVE-2026-80197
Fix available
8.7 High
-
kimai
Kimai before 2.58.0 Authentication Bypass via Password Reset Link
CVE-2026-80196
Fix available
8.7 High
-
kimai
Kimai: Arbitrary file read in invoice PDF renderer (admin)
CVE-2026-44298
Fix available
4.1 Medium
-
kimai
Kimai before 2.56.0 Information Disclosure via config() Twig Function
CVE-2026-80198
Fix available
8.7 High
-
kimai
Kimai before 2.56.0 Authorization Bypass via TimesheetVoter
CVE-2026-80202
Fix available
9.3 Critical
-
kimai
Kimai: Formula Injection via tag names in XLSX export
CVE-2026-42267
Fix available
5.4 Medium
-
kimai
Kimai: Team API Missing Object-Level Authorization
CVE-2026-41498
Fix available
3.3 Low
-
kimai
Kimai before 2.54.0 Username Enumeration via Timing Oracle
CVE-2026-80199
Fix available
6.3 Medium
-
kimai
Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate
CVE-2026-40486
Fix available
4.3 Medium
-
kimai
Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget
CVE-2026-40479
Fix available
5.4 Medium
-
kimai
Kimai before 2.53.0 API Token Leakage via Invoice Template
CVE-2026-80201
Fix available
2.0 Low
-
kimai
Kimai before 2.53.0 Open Redirect via RelayState
CVE-2026-80200
Fix available
5.3 Medium
-
kimai
Kimai: API invoice endpoint missing customer-level access control (IDOR)
CVE-2026-28685
Fix available
6.5 Medium
-
kevinpapst kimai
Kimai 2- persistent cross-site scripting (XSS)
CVE-2019-25317
Fix available
5.1 Medium
-
kimai
Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)
CVE-2026-23626
Fix available
6.8 Medium
-
kimai
Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking
CVE-2023-53957
8.5 High
-
kimai
Kimai 0.9.2 db_restore.php SQL Injection
CVE-2013-10033
Public exploit
9.3 Critical
-
kimai
Kimai Session information disclosure
CVE-2024-4596
Fix available
3.7 Low
-
kimai
API returns timesheet entries a user should not be authorized to view
CVE-2024-29200
Fix available
6.8 Medium
-
kimai
Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
CVE-2023-46245
Fix available
7.2 High
-
kimai
Cross-site Scripting in kimai/kimai
CVE-2020-19825
Fix available
9.6 Critical
-
kimai
Improper Neutralization of Formula Elements in a CSV File in Kimai 2
CVE-2021-43515
Fix available
7.8 High
-
kevinpapst kevinpapst/kimai2, kimai 2 +1 more
Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
CVE-2021-4033
Fix available
6.5 Medium
-
kevinpapst kevinpapst/kimai2, kimai kimai2 +1 more
Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2
CVE-2021-3985
Fix available
8.0 High
-
kevinpapst kevinpapst/kimai2, kimai 2 +1 more
Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
CVE-2021-3957
Fix available
4.6 Medium
-
kevinpapst kevinpapst/kimai2, kimai 2 +1 more
Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
CVE-2021-3963
Fix available
4.3 Medium
-
kevinpapst kevinpapst/kimai2, kimai 2 +1 more
Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
CVE-2021-3976
Fix available
4.3 Medium
-
kimai 2
Kimai v2 is vulnerable to Cross-Site Scripting (XSS)
CVE-2019-15481
Fix available
6.1 Medium