Description (CNA)
Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| kevinpapst / Kimai | affected 2 |
CWE
CWE-79
References
- https://www.exploit-db.com/exploits/47286
- https://github.com/kevinpapst/kimai2
- https://github.com/kevinpapst/kimai2/pull/962
- https://www.vulncheck.com/advisories/kimai-persistent-cross-site-scripting-xss
ADP enrichment
No English description supplied.
No references supplied.