Login Request a demo
KI
Vendor
kimai
3 products with CVEs on record
47
CVEs
0
On KEV
0
New 30D
Products
KI
kimai
kimai
9.6
41 CVEs0 on KEV0 new
K2
Kimai 2
Kimai
6.5
5 CVEs0 on KEV0 new
KI
Kimai2
Kimai
9.0
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-52827
KI
kimai
kimai
7.1
1%
Sep 15Kimai: Two-factor authentication bypass on the Kimai API
CVE-2026-52822
KI
kimai
kimai
5.3
0%
Sep 15Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation
CVE-2026-52828
KI
kimai
kimai
5.3
0%
Sep 15Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access
CVE-2026-52826
KI
kimai
kimai
5.3
0%
Sep 15Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation
CVE-2026-52823
KI
kimai
kimai
5.3
0%
Sep 15Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes
CVE-2026-52824
KI
kimai
kimai
9.1
1%
Sep 15Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
CVE-2026-52825
KI
kimai
kimai
5.3
0%
Sep 15Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility
CVE-2026-52821
KI
kimai
kimai
5.3
0%
Sep 15Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects
CVE-2026-52820
KI
kimai
kimai
5.3
0%
Sep 15Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass
CVE-2026-52819
KI
kimai
kimai
6.3
0%
Sep 15Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target
CVE-2026-49992
KI
kimai
kimai
6.3
0%
Sep 11Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes
CVE-2026-49865
KI
kimai
kimai
5.3
0%
Sep 11Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs
CVE-2026-84808
KI
kimai
kimai
4.3
0%
Sep 2Kimai before 2.65.0 Authorization Bypass via API Timesheet
CVE-2026-84807
KI
kimai
kimai
5.4
0%
Sep 2Kimai before 2.65.0 Authentication Bypass via Team Creation
CVE-2026-84806
KI
kimai
kimai
5.4
0%
Sep 2Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints
CVE-2026-84805
KI
kimai
kimai
4.3
0%
Sep 2Kimai 2.61.0 before 2.63.0 Authentication Bypass via API
CVE-2026-84804
KI
kimai
kimai
5.4
0%
Sep 2Kimai before 2.65.0 Authorization Bypass via Team Activity API
CVE-2026-80202
KI
kimai
kimai
8.8
0%
Aug 25Kimai before 2.56.0 Authorization Bypass via TimesheetVoter
CVE-2026-80201
KI
kimai
kimai
2.0
0%
Aug 25Kimai before 2.53.0 API Token Leakage via Invoice Template
CVE-2026-80200
KI
kimai
kimai
4.7
0%
Aug 25Kimai before 2.53.0 Open Redirect via RelayState
CVE-2026-80199
KI
kimai
kimai
3.7
0%
Aug 25Kimai before 2.54.0 Username Enumeration via Timing Oracle
CVE-2026-80198
KI
kimai
kimai
7.5
0%
Aug 25Kimai before 2.56.0 Information Disclosure via config() Twig Function
CVE-2026-80197
KI
kimai
kimai
4.3
0%
Aug 25Kimai before 2.57.0 Improper Authorization via Favorite Endpoints
CVE-2026-80196
KI
kimai
kimai
7.5
0%
Aug 25Kimai before 2.58.0 Authentication Bypass via Password Reset Link
CVE-2026-80195
KI
kimai
kimai
5.4
0%
Aug 25Kimai before 2.63.0 Team Membership Removal via API
CVE-2026-80194
KI
kimai
kimai
4.3
0%
Aug 25Kimai before 2.64.0 Missing Authorization via ProjectViewController export
CVE-2026-80193
KI
kimai
kimai
8.8
0%
Aug 25Kimai before 2.62.0 Authorization Bypass via QuickEntry
CVE-2026-44298
KI
kimai
kimai
4.9
0%
May 8Kimai: Arbitrary file read in invoice PDF renderer (admin)
CVE-2026-41498
KI
kimai
kimai
3.3
0%
May 8Kimai: Team API Missing Object-Level Authorization
CVE-2026-42267
KI
kimai
kimai
5.7
0%
May 8Kimai: Formula Injection via tag names in XLSX export
CVE-2026-40486
KI
kimai
kimai
4.3
0%
Apr 17Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate
CVE-2026-40479
KI
kimai
kimai
5.4
0%
Apr 17Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget
CVE-2026-28685
KI
kimai
kimai
6.5
0%
Mar 6Kimai: API invoice endpoint missing customer-level access control (IDOR)
CVE-2019-25317
KI
Kimai
Kimai
5.4
0%
Feb 11Kimai 2- persistent cross-site scripting (XSS)
CVE-2026-23626
KI
kimai
kimai
6.8
0%
Jan 18Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)
CVE-2023-53957
KI
Kimai
Kimai
8.8
1%
Dec 19Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking
CVE-2024-4596
KI
Kimai
Kimai
6.5
1%
May 7Kimai Session information disclosure
CVE-2024-29200
KI
kimai
kimai
6.5
1%
Mar 28API returns timesheet entries a user should not be authorized to view
CVE-2023-46245
KI
kimai
kimai
7.2
1%
Oct 31Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
CVE-2020-19825
KI
Kimai
Kimai
9.6
1%
Feb 15Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges
CVE-2021-43515
KI
Kimai
Kimai
7.8
1%
Apr 8CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai
CVE-2021-4033
K2
Kimai 2
Kimai
6.5
1%
Dec 9Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
CVE-2021-3985
KI
Kimai2
Kimai
9.0
1%
Dec 1Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2
CVE-2021-3957
K2
Kimai 2
Kimai
4.3
0%
Nov 19Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
CVE-2021-3963
K2
Kimai 2
Kimai
4.3
0%
Nov 19Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
CVE-2021-3976
K2
Kimai 2
Kimai
6.5
0%
Nov 19Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
CVE-2019-15481
K2
Kimai 2
Kimai
6.1
1%
Aug 23Kimai v2 before 1.1 has XSS via a timesheet description