CVE-2019-25317CWE-79cross-site-scripting

CVE-2019-25317

Medium · published February 11, 2026

CVSS v3.1

6.4

EPSS

Percentile

21.6

In the wild

Unconfirmed

What it is

Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.

The record

Technical detail

CVSS v3.1: 6.4 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00302 · 21.6th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2026-02-11T20:16Z

Affected products (1)

Product	Versions	Fixed in
kimai/kimai	≤ 1.1	—

References (4)

https://github.com/kevinpapst/kimai2 · [email protected]https://github.com/kevinpapst/kimai2/pull/962 · [email protected]https://www.exploit-db.com/exploits/47286 · [email protected]https://www.vulncheck.com/advisories/kimai-persistent-cross-site-scripting-xss · [email protected]

EPSS history

Timeline

11 FEB 14:56Z
Kimai 2- persistent cross-site scripting (XSS)
cvelistv5