CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

6 matches found

Github Security Blog•added 2026/07/13 11:55 p.m.•19 views

Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target

Summary GET /api/timesheets?user= and users= returns the targeted user's timesheet records to any caller that has the viewothertimesheet permission, without verifying that the caller is teamlead of any team containing the target user. The per-record endpoint GET /api/timesheets/id correctly...

6.3CVSS5.7AI score0.00496EPSS

SaveExploits0References2Affected Software1

RedhatCVE•added 2026/01/09 10:33 a.m.•14 views

CVE-2017-18581

The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list...

6.1CVSS6AI score0.00905EPSS

SaveExploits0References1

EUVD•added 2025/10/07 12:30 a.m.•16 views

EUVD-2017-9697

Malware in sbrugna...

6.1CVSS6.3AI score0.00905EPSS

SaveExploits0References2

NVD•added 2019/08/22 2:15 p.m.•21 views

CVE-2017-18581

The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list...

6.1CVSS6.1AI score0.00905EPSS

SaveExploits0References1

OSV•added 2019/08/22 2:15 p.m.•14 views

CVE-2017-18581

The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list...

6.1CVSS5.8AI score0.00905EPSS

SaveExploits0References1

Rapid7 Vulnerability Database (full)•added 2019/08/22 12:00 a.m.•2 views

CVE-2017-18581: Improper Neutralization of Input During Web Page Generation

The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list...

6.1CVSS5.8AI score0.00905EPSS

SaveExploits0References2

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by