CVE-2025-28254

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions...

CVE-2025-28254

A Cross-Site Scripting (XSS) vulnerability exists in Leantime v3.2.1 and earlier versions. The root cause is the improper neutralization of HTML tags within the first name field, specifically during the execution of the processMentions() function. An authenticated attacker can exploit this to exe...