{"id":"CVE-2021-3963","aliases":["GHSA-gf2c-93hm-r9j5"],"url":"https://o3.security/vulnerability/CVE-2021-3963","summary":"Cross-site Scripting in kimai2","details":"kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) in deleting invoice templates. This vulnerability is capable of tricking admin user to delete invoice templates.","published":"2021-11-19T12:15:09.110Z","modified":"2026-08-27T08:39:41.461231Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":{"score":0.00382,"percentile":0.31534,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"kevinpapst/kimai2","fixedVersion":"1.16"}],"fix":{"url":"https://github.com/kevinpapst/kimai2/commit/95796ab2560ad93f44068a88f0fad758c2053514","label":"kevinpapst/kimai2@95796ab"},"references":[{"type":"FIX","url":"https://github.com/kevinpapst/kimai2/commit/95796ab2560ad93f44068a88f0fad758c2053514"},{"type":"FIX","url":"https://huntr.dev/bounties/3abf308b-7dbd-4864-b1a9-5c45b876def8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3963"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T08:39:41.461231Z"}}