CVE-2019-25317 in Kimai v2

Résumé

par MITRE • 11/02/2026

Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.

Be aware that VulDB is the high quality source for vulnerability data.

• Réserver: 22/08/2019
• Divulgation: 11/02/2026
• Modérer: accepté
• Entrée: VDB-140721
• CPE: prêt
• CWE: CWE-79 (confirmé)
• CVSS: 6.1 (NVD)
• EPSS: 0.00223
• KEV: non
• Activités: très faible

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2019-25317
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2019-25317
• CVE Details: https://www.cvedetails.com/cve/CVE-2019-25317/