Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

kimai Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-49992`Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes	Exploitation statusNot confirmed	FixNot confirmed	Affected productkimai	Published09/11/2026	SeverityMedium
`CVE-2026-49865`Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs	Exploitation statusNot confirmed	FixNot confirmed	Affected productkimai	Published09/11/2026	SeverityMedium
`CVE-2026-84808`Kimai before 2.65.0 Authorization Bypass via API Timesheet	Exploitation statusNot known exploited	FixYes	Affected productkimai	Published09/02/2026	SeverityMedium
`CVE-2026-84807`Kimai before 2.65.0 Authentication Bypass via Team Creation	Exploitation statusNot known exploited	FixYes	Affected productkimai	Published09/02/2026	SeverityMedium
`CVE-2026-84806`Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints	Exploitation statusNot known exploited	FixYes	Affected productkimai	Published09/02/2026	SeverityMedium
`CVE-2026-84805`Kimai 2.61.0 before 2.63.0 Authentication Bypass via API	Exploitation statusNot known exploited	FixYes	Affected productkimai	Published09/02/2026	SeverityMedium
`CVE-2026-84804`Kimai before 2.65.0 Authorization Bypass via Team Activity API	Exploitation statusNot known exploited	FixYes	Affected productkimai	Published09/02/2026	SeverityMedium
`CVE-2026-80202`Kimai before 2.56.0 Authorization Bypass via TimesheetVoter	Exploitation statusPublic exploit	FixYes	Affected productkimai	Published08/25/2026	SeverityCritical
`CVE-2026-80201`Kimai before 2.53.0 API Token Leakage via Invoice Template	Exploitation statusPublic exploit	FixYes	Affected productkimai	Published08/25/2026	SeverityLow
`CVE-2026-80200`Kimai before 2.53.0 Open Redirect via RelayState	Exploitation statusNot known exploited	FixYes	Affected productkimai	Published08/25/2026	SeverityMedium
`CVE-2026-80199`Kimai before 2.54.0 Username Enumeration via Timing Oracle	Exploitation statusPublic exploit	FixYes	Affected productkimai	Published08/25/2026	SeverityMedium
`CVE-2026-80198`Kimai before 2.56.0 Information Disclosure via config() Twig Function	Exploitation statusNot known exploited	FixYes	Affected productkimai	Published08/25/2026	SeverityHigh
`CVE-2026-80197`Kimai before 2.57.0 Improper Authorization via Favorite Endpoints	Exploitation statusNot known exploited	FixYes	Affected productkimai	Published08/25/2026	SeverityHigh
`CVE-2026-80196`Kimai before 2.58.0 Authentication Bypass via Password Reset Link	Exploitation statusPublic exploit	FixYes	Affected productkimai	Published08/25/2026	SeverityHigh
`CVE-2026-80195`Kimai before 2.63.0 Team Membership Removal via API	Exploitation statusNot known exploited	FixYes	Affected productkimai	Published08/25/2026	SeverityHigh
`CVE-2026-80194`Kimai before 2.64.0 Missing Authorization via ProjectViewController export	Exploitation statusNot known exploited	FixYes	Affected productkimai	Published08/25/2026	SeverityHigh
`CVE-2026-80193`Kimai before 2.62.0 Authorization Bypass via QuickEntry	Exploitation statusNot known exploited	FixYes	Affected productkimai	Published08/25/2026	SeverityHigh
`CVE-2026-44298`Kimai: Arbitrary file read in invoice PDF renderer (admin)	Exploitation statusNot known exploited	FixYes	Affected productkimai	Published05/08/2026	SeverityMedium
`CVE-2026-41498`Kimai: Team API Missing Object-Level Authorization	Exploitation statusPublic exploit	FixYes	Affected productkimai	Published05/08/2026	SeverityLow
`CVE-2026-42267`Kimai: Formula Injection via tag names in XLSX export	Exploitation statusPublic exploit	FixYes	Affected productkimai	Published05/08/2026	SeverityMedium
`CVE-2026-40486`Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate	Exploitation statusPublic exploit	FixYes	Affected productkimai	Published04/17/2026	SeverityMedium
`CVE-2026-40479`Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget	Exploitation statusPublic exploit	FixYes	Affected productkimai	Published04/17/2026	SeverityMedium
`CVE-2026-28685`Kimai: API invoice endpoint missing customer-level access control (IDOR)	Exploitation statusPublic exploit	FixYes	Affected productkimai	Published03/06/2026	SeverityMedium
`CVE-2019-25317`Kimai 2- persistent cross-site scripting (XSS)	Exploitation statusPublic exploit	FixNot confirmed	Affected productKimai	Published02/11/2026	SeverityMedium
`CVE-2026-23626`Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)	Exploitation statusNot known exploited	FixNot confirmed	Affected productkimai	Published01/18/2026	SeverityMedium
`CVE-2023-53957`Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking	Exploitation statusPublic exploit	FixNot confirmed	Affected productkimai	Published12/19/2025	SeverityHigh
`CVE-2024-4596`Kimai Session information disclosure	Exploitation statusNot known exploited	FixYes	Affected productKimai	Published05/07/2024	SeverityLow
`CVE-2024-29200`API returns timesheet entries a user should not be authorized to view	Exploitation statusNot known exploited	FixYes	Affected productkimai	Published03/28/2024	SeverityMedium
`CVE-2023-46245`Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File	Exploitation statusNot confirmed	FixNot confirmed	Affected productkimai	Published10/31/2023	SeverityHigh
`CVE-2020-19825`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published02/15/2023	SeverityCritical
`CVE-2021-43515`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published04/08/2022	SeverityUnknown
`CVE-2021-4033`Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2	Exploitation statusNot confirmed	FixYes	Affected productkevinpapst/kimai2	Published12/09/2021	SeverityMedium
`CVE-2021-3985`Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2	Exploitation statusNot confirmed	FixYes	Affected productkevinpapst/kimai2	Published12/01/2021	SeverityHigh
`CVE-2021-3957`Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2	Exploitation statusNot confirmed	FixYes	Affected productkevinpapst/kimai2	Published11/19/2021	SeverityMedium
`CVE-2021-3963`Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2	Exploitation statusNot confirmed	FixYes	Affected productkevinpapst/kimai2	Published11/19/2021	SeverityMedium
`CVE-2021-3976`Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2	Exploitation statusNot confirmed	FixYes	Affected productkevinpapst/kimai2	Published11/19/2021	SeverityMedium
`CVE-2019-15481`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published08/23/2019	SeverityUnknown

37 / 37 Results

All vulnerabilities loaded

Security vulnerabilities from kimai

kimai

How many security vulnerabilities does kimai have?

Which kimai product has the most security vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management

Popular kimai products

kimai