Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

kevinpapst/kimai2

9 known vulnerabilities (1 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 1 high, 6 medium
Registry
Packagist

Advisories 9

  • CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai.

    Affected: fixed in 1.14.1.

  • CVE-2021-4033Medium 6.5

    Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2

    Affected: fixed in 1.16.7.

  • CVE-2021-3983Medium 6.3

    Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2

    Affected: fixed in 1.16.3.

  • Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2

    Affected: fixed in 1.16.3.

  • CVE-2021-3992Medium 6.5

    Improper Access Control in kevinpapst/kimai2

    Affected: fixed in 1.16.3.

  • CVE-2021-3957Medium 4.6

    Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2

    Affected: fixed in 1.16.

  • CVE-2021-3963Medium 4.3

    Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2

    Affected: fixed in 1.16.

  • CVE-2021-3976Medium 4.3

    Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2

    Affected: fixed in 1.16.2.

  • Kimai v2 before 1.1 has XSS via a timesheet description.

    Affected: fixed in 1.1.