CVE-2025-28254

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions...

CVE-2025-28254

creationtimestamp| type| source ---|---|--- 2025-03-28 21:29:18+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/9483 2025-03-29 00:27:05+00:00| seen| https://t.me/cvedetector/21487...

CVE-2025-28254

CVE-2025-28254 concerns Leantime v3.2.1 and earlier and describes an authenticated XSS vulnerability triggered by the first name field in processMentions(), potentially allowing arbitrary code execution and access to sensitive information. Affected component: Leantime’s processMentions implementa...