Skip to content
OpenAdvisories

Vendor

Kimai Project

38 known vulnerabilities.

Products

kimai 38
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-52824 Public exploit Scanner template

    Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

    Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_this_to_something_unique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony u…

    Kimai Project kimai kimai/kimai Packagist
  • Critical 9.3
    CVE-2013-10033 Public exploit

    Kimai 0.9.2 db_restore.php SQL Injection

    An unauthenticated SQL injection vulnerability exists in Kimai version 0.9.2.x via the db_restore.php endpoint. The flaw allows attackers to inject arbitrary SQL queries into the dates[] POST parameter, enabling file write via INTO OUTFILE under specific envi…

    Kimai Project kimai