PT-2026-7611 · Kimai2 · Kimai2

Osamaalaa · Published 2026-02-11 · Updated 2026-02-19 · CVE-2019-25317

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kimai 2 (affected versions not specified)

Description The software contains a persistent cross-site scripting issue that enables attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads into the description field, leading to the execution of arbitrary JavaScript when the page is loaded and viewed by other users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25317

GHSA-9278-6HCJ-2P4J

Affected Products

Kimai2

References · 12

• 🔥 https://exploit-db.com/exploits/47286 · Exploit
• https://github.com/kevinpapst/kimai2/pull/962 · Patch
• https://osv.dev/vulnerability/GHSA-9278-6hcj-2p4j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-25317 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25317 · Security Note
• https://github.com/kimai/kimai · Note
• https://github.com/kevinpapst/kimai2 · Note
• https://github.com/kimai/kimai/commit/a0e8aa3a435717187fb12210242dab1b7c97ff3f · Note
• https://reddit.com/r/VulnMatter/comments/1r2tzxw/resumen_diario_de_vulnerabilidades_12022026 · Reddit Post
• https://vulncheck.com/advisories/kimai-persistent-cross-site-scripting-xss · Note
• https://t.me/CVEtracker/44430 · Telegram Post
• https://t.me/cveNotify/152526 · Telegram Post