CVE-2019-25317
Medium · 6.4CVSS
6.4
EPSS
0.3%
Published
Feb 11, 2026
CISA due date
—
The record
Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | kimai/kimai | 0 | 1.1 |
Related vulnerabilities
- GHSA-9278-6hcj-2p4j Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions Same vulnerability
- CVE-2026-28685 Kimai is a web-based multi-user time-tracking application. Also affects kimai/kimai
- GHSA-v33r-r6h2-8wr7 Kimai's API invoice endpoint missing customer-level access control (IDOR) Also affects kimai/kimai
- GHSA-jg2j-2w24-54cg Kimai has an Authenticated Server-Side Template Injection (SSTI) Also affects kimai/kimai
- CVE-2026-23626 Kimai is a web-based multi-user time-tracking application. Also affects kimai/kimai
- GHSA-cv8h-r7r5-vwj9 Kimai contains a SameSite cookie vulnerability Also affects kimai/kimai
- CVE-2023-53957 Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal… Also affects kimai/kimai
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79