CVE Intelligence

Kivitendo vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Kivitendo products: 1 record(s), with severity, exploitation and fixes.

Kivitendo 1

Exploited only (KEV) →

CVE-2025-66370 Medium · 5.0 CWE-611 Nov 28, 2025
XML External Entity (XXE) in Kivitendo
Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.