CVE-2026-52819

Kimai is an open-source time tracking application. Prior to 2.57.0, the GET /api/timesheets list endpoint accepts user and users target identifiers from a caller with viewothertimesheet but does not apply accessuser or verify that a ROLETEAMLEAD requester leads a team containing each target user...

CVE-2026-84808

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with viewothertimesheet permission can list timesheets using activities restricted to teams they do not belong to,...

CVE-2026-84808 Kimai before 2.65.0 Authorization Bypass via API Timesheet

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with viewothertimesheet permission can list timesheets using activities restricted to teams they do not belong to,...

CVE-2026-84808

Kimai (a self-hosted time-tracking application) versions before 2.65.0 are affected by an authorization bypass in the REST API timesheet collection endpoint. The vulnerability stems from a failure to enforce activity-team access controls : a user holding the view_other_timesheet permission can li...

PT-2026-84681

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view other timesheet permission can list timesheets using activities restricted to teams they do not belong to,...

Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

Summary The Timesheet API PATCH /api/timesheets/id and POST /api/timesheets endpoints accept a user-supplied project ID and resolve it through a Symfony EntityType whose querybuilder allows the submitted ID to satisfy the access predicate via an unconditional OR branch. As a result, any...

CVE-2024-9319

A vulnerability, which was classified as critical, was found in SourceCodester Online Timesheet App 1.0. This affects an unknown part of the file /endpoint/delete-timesheet.php. The manipulation of the argument timesheet leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2024-9320

A vulnerability has been found in SourceCodester Online Timesheet App 1.0 and classified as problematic. This vulnerability affects unknown code of the file /endpoint/add-timesheet.php of the component Add Timesheet Form. The manipulation of the argument day/task leads to cross site scripting. Th...

CVE-2024-9319

A vulnerability, which was classified as critical, was found in SourceCodester Online Timesheet App 1.0. This affects an unknown part of the file /endpoint/delete-timesheet.php. The manipulation of the argument timesheet leads to sql injection. It is possible to initiate the attack remotely. The...

SourceCodester Online Timesheet App 跨站脚本漏洞

SourceCodester Online Timesheet App is a SourceCodester open source web application built with PHP and MySQL designed to simplify time management and task tracking. A cross-site scripting vulnerability exists in version 1.0 of the SourceCodester Online Timesheet App, which stems from a cross-site...

PT-2024-39568 · Unknown · Sourcecodester Online Timesheet App

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Timesheet App version 1.0 Description: A critical vulnerability was found in the SourceCodester Online Timesheet App, affecting an unknown part of the file /endpoint/delete-timesheet.php. The manipulation of the timeshee...

SourceCodester Online Timesheet App SQL注入漏洞

SourceCodester Online Timesheet App is a web application from SourceCodester built with PHP and MySQL designed to simplify time management and task tracking. A SQL injection vulnerability exists in the SourceCodester Online Timesheet App version 1.0, which stems from an SQL injection issue...

CVE-2022-27108

OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...