Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget

Kimai has a security flaw where user profile names aren't properly escaped when displayed in forms, allowing attackers to inject malicious code that runs when administrators view the page. An attacker with regular user access can store this malicious code to steal admin credentials or perform actions as an administrator.

The escapeForHtml() function in KimaiEscape.js fails to escape quote characters (single and double), enabling HTML attribute injection when user aliases are rendered via innerHTML in the team member widget. An authenticated attacker with ROLE_USER can craft a malicious alias containing JavaScript payloads that execute in an administrator's browser context, achieving stored XSS and privilege escalation.