{"id":"CVE-2021-3976","aliases":["GHSA-427q-jp8v-ww95"],"url":"https://o3.security/vulnerability/CVE-2021-3976","summary":"Cross-site Scripting in kimai2","details":"kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)","published":"2021-11-19T11:15:07.880Z","modified":"2026-07-08T05:59:52.646685873Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"kevinpapst/kimai2","fixedVersion":"1.16.2"}],"fix":{"url":"https://github.com/kevinpapst/kimai2/commit/b28e9c120c87222e21a238f1b03a609d6a5d506e","label":"kevinpapst/kimai2@b28e9c1"},"references":[{"type":"FIX","url":"https://github.com/kevinpapst/kimai2/commit/b28e9c120c87222e21a238f1b03a609d6a5d506e"},{"type":"FIX","url":"https://huntr.dev/bounties/0567048a-118c-42ec-9f94-b55533017406"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T05:59:52.646685873Z"}}