Critical severity9.6NVD Advisory· Published Feb 15, 2023· Updated Jun 17, 2026

CVE-2020-19825

Description

Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
kimai/kimaiPackagist	< 1.1	1.1

Affected products

Kimai/Kimai
cpe:2.3:a:kimai:kimai:1.30.0:*:*:*:*:*:*:*
Kevinpapst/Kimai2cpe-rescue
ghsa-coords
pkg:composer/kimai/kimai
Range: < 1.1

Patches

Vulnerability mechanics

References

github.com/kevinpapst/kimai2/pull/962/filesnvdPatchWEB
github.com/advisories/GHSA-r58m-v5pr-jhhqghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2020-19825ghsaADVISORY
github.com/kimai/kimai/pull/962ghsaWEB
github.com/kimai/kimai/releases/tag/1.1ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.624
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000