{"action":"Upgrade kimai/kimai to 1.1 or later.","affected":[{"fixed":"1.1","introduced":"0"}],"component":"kimai/kimai","cve_ids":["CVE-2019-25317"],"ecosystem":"Packagist","epss":0.00302,"exploited":false,"fixed_versions":["1.1"],"ghsa_id":"GHSA-9278-6hcj-2p4j","id":"tcs_01M5KEZGDWB9XY1EA2QHK5QFK8","modified_at":"2026-02-11T18:56:17.400710Z","published_at":"2026-02-11T15:30:27Z","references":["https://osv.dev/vulnerability/GHSA-9278-6hcj-2p4j","https://nvd.nist.gov/vuln/detail/CVE-2019-25317","https://github.com/kevinpapst/kimai2/pull/962","https://github.com/kimai/kimai/commit/a0e8aa3a435717187fb12210242dab1b7c97ff3f","https://github.com/kevinpapst/kimai2","https://github.com/kimai/kimai","https://www.exploit-db.com/exploits/47286","https://www.vulncheck.com/advisories/kimai-persistent-cross-site-scripting-xss"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-9278-6hcj-2p4j","url":"https://osv.dev/vulnerability/GHSA-9278-6hcj-2p4j"}],"summary":"Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions"}