Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges

Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

Kimai before 2.56.0 Authorization Bypass via TimesheetVoter

Kimai before 2.62.0 Authorization Bypass via QuickEntry

Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai

Kimai before 2.56.0 Information Disclosure via config() Twig Function

Kimai before 2.58.0 Authentication Bypass via Password Reset Link

Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File

Kimai: Two-factor authentication bypass on the Kimai API

Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)

Kimai: API invoice endpoint missing customer-level access control (IDOR)

Kimai Session information disclosure

API returns timesheet entries a user should not be authorized to view

Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target

Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

Kimai: Formula Injection via tag names in XLSX export

Kimai before 2.65.0 Authentication Bypass via Team Creation

Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints

Kimai before 2.65.0 Authorization Bypass via Team Activity API

Kimai before 2.63.0 Team Membership Removal via API

Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget

Kimai 2- persistent cross-site scripting (XSS)

Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation

Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access

Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes

Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility

Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects

Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

Kimai: Arbitrary file read in invoice PDF renderer (admin)

Kimai before 2.53.0 Open Redirect via RelayState

Kimai before 2.65.0 Authorization Bypass via API Timesheet

Kimai 2.61.0 before 2.63.0 Authentication Bypass via API

Kimai before 2.57.0 Improper Authorization via Favorite Endpoints

Kimai before 2.64.0 Missing Authorization via ProjectViewController export

Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate

Kimai before 2.54.0 Username Enumeration via Timing Oracle

Kimai: Team API Missing Object-Level Authorization

Kimai before 2.53.0 API Token Leakage via Invoice Template