CVE-2025-28254

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions...

CVE-2025-28254

The project management system Leantime (v3.2.1 and before) is vulnerable to Cross-Site Scripting (XSS) via the first name field within the processMentions() method. This vulnerability arises from the improper neutralization of input , allowing an authenticated attacker to inject arbitrary HTML or...