Cross-site Scripting in kimai2

MEDIO 4.3CVE-2021-3963 · GHSA-gf2c-93hm-r9j5 · Published 19/11/2021 · updated 17/06/2026

In breve

CVE-2021-3963 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda kevinpapst/kimai2, kimai 2 (kimai).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.40%, superiore al 33.7% delle vulnerabilità.
Correzione: aggiornare a 1.16, 1.16.2 o successiva.

Package	Affected versions	Patched versions
kevinpapst/kimai2 Packagist	`< 1.16`	`1.16`
kimai 2 kimai	`< 1.16.2`	`1.16.2`

Description

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) in deleting invoice templates. This vulnerability is capable of tricking admin user to delete invoice templates.

NVD description

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)

References

nvd.nist.gov/vuln/detail/CVE-2021-3963 · ADVISORY
kevinpapst/kimai2 commit 95796ab · WEB
huntr.dev/bounties/3abf308b-7dbd-4864-b1a9-5c45b876def8 · WEB

Altre vulnerabilità di kevinpapst/kimai2

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

kevinpapst/kimai2

Packagist

< 1.16

1.16

kimai 2

kimai

< 1.16.2

1.16.2

Altre vulnerabilità di kevinpapst/kimai2

Vedi tutto →