Cross-Site Request Forgery (CSRF)

kevinpapst/kimai2 is vulnerable to cross-site request forgery. The vulnerability exists in createInvoiceAction of InvoiceController.php which allows a malicious attacker to trick users to modify status of invoices and disrupt the tracking of invoices...

Privilege Escalation

kevinpapst/kimai2 is vulnerable to privilege escalation. The vulnerability exists through the lack of permission checks in 'InvoiceController.php', allowing a malicious user to access invoices without read permissions...