kimai — Vulnerabilities & Security Advisories 37

Kimai is an open-source time-tracking application designed for businesses to monitor employee working hours and project costs. Historically, it has been vulnerable to multiple security issues including remote code execution, cross-site scripting, and privilege escalation flaws. The application's web interface has frequently contained input validation weaknesses allowing attackers to execute unauthorized commands or steal session data. While no major public incidents have been widely documented, the seven recorded CVEs highlight consistent security concerns in areas like authentication, access control, and data sanitization. Its modular architecture, while flexible, introduces potential attack surfaces through plugins and extensions that may not undergo rigorous security review.