kimai kayıtları

kimai üreticisine ait 20 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren: 0 · %0
Silahlaştırılmış: 0 · %0
Pre-auth RCE: 0
Düzeltme kaydı olan: %95
Yayından KEV’e ortanca: KEV’e giren kayıt yok

Yıllara göre kayıt

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

Saldırı profili

Tüm kayıtlar

20 kayıt

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
38İzleyin	CVE-2020-19825İstismar yok	Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain eskimai · kimai · CWE-79 Kimlik doğrulamasız XSS	Kritik9,6	—	%0,6	15 Şub 2023
36İzleyin	CVE-2021-3985İstismar yok	Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2kimai · kimai2 · CWE-79 XSS	Kritik9,0	—	%1,2	1 Ara 2021
34İzleyin	CVE-2023-53957İstismar yok	Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijackingkimai · kimai · CWE-1275 Kimlik doğrulamasız	Yüksek8,5	—	%0,5	19 Ara 2025
31İzleyin	CVE-2021-43515İstismar yok	CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai.kimai · kimai · CWE-1236	Yüksek7,8	—	%1,0	8 Nis 2022
28İzleyin	CVE-2023-46245İstismar yok	Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig Filekimai · kimai · CWE-1336 RCE SSTI	Yüksek7,2	—	%1,4	31 Eki 2023
27İzleyin	CVE-2026-23626İstismar yok	Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)kimai · kimai · CWE-1336 RCE SSTI CSRF	Orta6,8	—	%0,4	18 Oca 2026
26İzleyin	CVE-2024-4596İstismar yok	Kimai Session information disclosurekimai · kimai · CWE-200 Bilgi sızıntısı	Orta6,5	—	%0,7	7 May 2024
26İzleyin	CVE-2024-29200İstismar yok	API returns timesheet entries a user should not be authorized to viewkimai · kimai · CWE-1220	Orta6,5	—	%0,6	28 Mar 2024
26İzleyin	CVE-2021-4033İstismar yok	Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2kimai · kimai 2 · CWE-352 Kimlik doğrulamasız CSRF	Orta6,5	—	%0,5	9 Ara 2021
26İzleyin	CVE-2026-28685İstismar yok	Kimai: API invoice endpoint missing customer-level access control (IDOR)kimai · kimai · CWE-285 Erişim denetimi (IDOR)	Orta6,5	—	%0,4	6 Mar 2026
26İzleyin	CVE-2021-3976İstismar yok	Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2kimai · kimai 2 · CWE-352 Kimlik doğrulamasız CSRF	Orta6,5	—	%0,3	19 Kas 2021
24İzleyin	CVE-2019-15481İstismar yok	Kimai v2 before 1.1 has XSS via a timesheet description.kimai · kimai 2 · CWE-79 Kimlik doğrulamasız XSS	Orta6,1	—	%0,8	23 Ağu 2019
21İzleyin	CVE-2026-42267İstismar yok	Kimai: Formula Injection via tag names in XLSX exportkimai · kimai · CWE-1236	Orta5,4	—	%0,3	8 May 2026
21İzleyin	CVE-2026-40479İstismar yok	Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widgetkimai · kimai · CWE-79 XSS	Orta5,4	—	%0,2	17 Nis 2026
20İzleyin	CVE-2019-25317İstismar yok	Kimai 2- persistent cross-site scripting (XSS)kimai · kimai · CWE-79 RCE XSS	Orta5,1	—	%0,3	11 Şub 2026
19İzleyin	CVE-2026-44298İstismar yok	Kimai: Arbitrary file read in invoice PDF renderer (admin)kimai · kimai · CWE-22 Yol geçişi	Orta4,9	—	%0,4	8 May 2026
17İzleyin	CVE-2021-3963İstismar yok	Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2kimai · kimai 2 · CWE-352 Kimlik doğrulamasız CSRF	Orta4,3	—	%0,3	19 Kas 2021
17İzleyin	CVE-2021-3957İstismar yok	Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2kimai · kimai 2 · CWE-352 Kimlik doğrulamasız CSRF	Orta4,3	—	%0,3	19 Kas 2021
17İzleyin	CVE-2026-40486İstismar yok	Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_ratekimai · kimai · CWE-915	Orta4,3	—	%0,3	17 Nis 2026
13İzleyin	CVE-2026-41498İstismar yok	Kimai: Team API Missing Object-Level Authorizationkimai · kimai · CWE-862 Erişim denetimi (IDOR)	Düşük3,3	—	%0,2	8 May 2026

CVE-2020-19825
38İzleyin
Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain es
KritikCVSS 9,6İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
kimai · kimai15 Şub 2023
CVE-2021-3985
36İzleyin
Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2
KritikCVSS 9,0İstismar yokEPSS %1
- XSS
kimai · kimai21 Ara 2021
CVE-2023-53957
34İzleyin
Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking
YüksekCVSS 8,5İstismar yokEPSS %0
- Kimlik doğrulamasız
kimai · kimai19 Ara 2025
CVE-2021-43515
31İzleyin
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai.
YüksekCVSS 7,8İstismar yokEPSS %1
kimai · kimai8 Nis 2022
CVE-2023-46245
28İzleyin
Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
YüksekCVSS 7,2İstismar yokEPSS %1
- RCE
- SSTI
kimai · kimai31 Eki 2023
CVE-2026-23626
27İzleyin
Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)
OrtaCVSS 6,8İstismar yokEPSS %0
- RCE
- SSTI
- CSRF
kimai · kimai18 Oca 2026
CVE-2024-4596
26İzleyin
Kimai Session information disclosure
OrtaCVSS 6,5İstismar yokEPSS %0
- Bilgi sızıntısı
kimai · kimai7 May 2024
CVE-2024-29200
26İzleyin
API returns timesheet entries a user should not be authorized to view
OrtaCVSS 6,5İstismar yokEPSS %0
kimai · kimai28 Mar 2024
CVE-2021-4033
26İzleyin
Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
OrtaCVSS 6,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- CSRF
kimai · kimai 29 Ara 2021
CVE-2026-28685
26İzleyin
Kimai: API invoice endpoint missing customer-level access control (IDOR)
OrtaCVSS 6,5İstismar yokEPSS %0
- Erişim denetimi (IDOR)
kimai · kimai6 Mar 2026
CVE-2021-3976
26İzleyin
Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
OrtaCVSS 6,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- CSRF
kimai · kimai 219 Kas 2021
CVE-2019-15481
24İzleyin
Kimai v2 before 1.1 has XSS via a timesheet description.
OrtaCVSS 6,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
kimai · kimai 223 Ağu 2019
CVE-2026-42267
21İzleyin
Kimai: Formula Injection via tag names in XLSX export
OrtaCVSS 5,4İstismar yokEPSS %0
kimai · kimai8 May 2026
CVE-2026-40479
21İzleyin
Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget
OrtaCVSS 5,4İstismar yokEPSS %0
- XSS
kimai · kimai17 Nis 2026
CVE-2019-25317
20İzleyin
Kimai 2- persistent cross-site scripting (XSS)
OrtaCVSS 5,1İstismar yokEPSS %0
- RCE
- XSS
kimai · kimai11 Şub 2026
CVE-2026-44298
19İzleyin
Kimai: Arbitrary file read in invoice PDF renderer (admin)
OrtaCVSS 4,9İstismar yokEPSS %0
- Yol geçişi
kimai · kimai8 May 2026
CVE-2021-3963
17İzleyin
Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
OrtaCVSS 4,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- CSRF
kimai · kimai 219 Kas 2021
CVE-2021-3957
17İzleyin
Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
OrtaCVSS 4,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- CSRF
kimai · kimai 219 Kas 2021
CVE-2026-40486
17İzleyin
Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate
OrtaCVSS 4,3İstismar yokEPSS %0
kimai · kimai17 Nis 2026
CVE-2026-41498
13İzleyin
Kimai: Team API Missing Object-Level Authorization
DüşükCVSS 3,3İstismar yokEPSS %0
- Erişim denetimi (IDOR)
kimai · kimai8 May 2026