CVE-2026-40486

Kimai is an open-source time tracking application. In versions 2.52.0 and below, the User Preferences API endpoint PATCH /api/users/id/preferences applies submitted preference values without checking the isEnabled flag on preference objects. Although the hourlyrate and internalrate fields are...

CVE-2026-40486

Kimai is an open-source time tracking application. In versions 2.52.0 and below, the User Preferences API endpoint PATCH /api/users/id/preferences applies submitted preference values without checking the isEnabled flag on preference objects. Although the hourlyrate and internalrate fields are...

CVE-2026-40486

Kimai is an open-source time tracking application. In versions 2.52.0 and below, the User Preferences API endpoint PATCH /api/users/id/preferences applies submitted preference values without checking the isEnabled flag on preference objects. Although the hourlyrate and internalrate fields are...

CVE-2026-40486: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Kimai is an open-source time tracking application. In versions 2.52.0 and below, the User Preferences API endpoint PATCH /api/users/id/preferences applies submitted preference values without checking the isEnabled flag on preference objects. Although the hourlyrate and internalrate fields are...

kimai 安全漏洞

Kimai is a web-based, multi-user time tracking application developed by Kimai’s individual developer. Versions of Kimai 2.52.0 and earlier contained security vulnerabilities. These vulnerabilities stemmed from the lack of checks on the isEnabled flag in the user preference settings API endpoint,...

CVE-2024-3028

CVE-2024-3028 affects mintplex-labs/anything-llm. The issue is improper input validation in the system-preferences API where manipulating the logo_filename parameter can cause reading of arbitrary files (including .env) and deletion via remove-logo. Root cause: lack of proper sanitization of user...

[SA13993] ginp Java Preferences API Security Bypass

TITLE: ginp Java Preferences API Security Bypass SECUNIA ADVISORY ID: SA13993 VERIFY ADVISORY: http://secunia.com/advisories/13993/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: From remote SOFTWARE: ginp 0.x http://secunia.com/product/4566/ DESCRIPTION: A security issue has been reporte...