CVE-2025-28254

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions...

CVE-2025-28254

creationtimestamp| type| source ---|---|--- 2025-03-28 21:29:18+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/9483 2025-03-29 00:27:05+00:00| seen| https://t.me/cvedetector/21487...

CVE-2025-28254

The project management system Leantime (v3.2.1 and before) is vulnerable to Cross-Site Scripting (XSS) via the first name field within the processMentions() method. This vulnerability arises from the improper neutralization of input , allowing an authenticated attacker to inject arbitrary HTML or...