Kimai — Vulnerabilities & Security Advisories 10

All 10 CVE vulnerabilities found in Kimai, with AI-generated Chinese analysis, references, and POCs.

Vendor: kimai

CVE ID	Title	CVSS	Severity	Published
CVE-2026-40486	Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate CWE-915	4.3	Medium	2026-04-17
CVE-2026-40479	Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget CWE-79	5.4	Medium	2026-04-17
CVE-2026-28685	Kimai: API invoice endpoint missing customer-level access control (IDOR) CWE-285	6.5	Medium	2026-03-06
CVE-2019-25317	Kimai 2- persistent cross-site scripting (XSS) CWE-79	6.4	Medium	2026-02-11
CVE-2026-23626	Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI) CWE-1336	6.8	Medium	2026-01-18
CVE-2023-53957	Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking CWE-1275	9.8	Critical	2025-12-19
CVE-2013-10033	Kimai 0.9.2 db_restore.php SQL Injection CWE-89	9.8^AI	Critical^AI	2025-07-31
CVE-2024-4596	Kimai Session information disclosure CWE-200	3.7	Low	2024-05-07
CVE-2024-29200	API returns timesheet entries a user should not be authorized to view CWE-1220	6.8	Medium	2024-03-28
CVE-2023-46245	Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File CWE-1336	7.2	High	2023-10-31

All 10 known CVE vulnerabilities affecting Kimai with full Chinese analysis, references, and POCs where available.