CVE-2025-28254

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-28254
Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/Leantime/leantime/blob/0e7ddbbe3d582f657a1dddfef7b3419ae588cbf7/app/Domain/Notifications/Services/Notifications.php#L128 Product
https://github.com/Leantime/leantime/commit/ce1d2073e4601183e1bdd90f4b433d16aee46a50 Patch
https://github.com/Leantime/leantime/security/advisories/GHSA-95j3-435g-vjcp Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*
History

07 Apr 2025, 14:42

Type Values Removed Values Added
First Time Leantime
Leantime leantime
CPE cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*
References () https://github.com/Leantime/leantime/blob/0e7ddbbe3d582f657a1dddfef7b3419ae588cbf7/app/Domain/Notifications/Services/Notifications.php#L128 - () https://github.com/Leantime/leantime/blob/0e7ddbbe3d582f657a1dddfef7b3419ae588cbf7/app/Domain/Notifications/Services/Notifications.php#L128 - Product
References () https://github.com/Leantime/leantime/commit/ce1d2073e4601183e1bdd90f4b433d16aee46a50 - () https://github.com/Leantime/leantime/commit/ce1d2073e4601183e1bdd90f4b433d16aee46a50 - Patch
References () https://github.com/Leantime/leantime/security/advisories/GHSA-95j3-435g-vjcp - () https://github.com/Leantime/leantime/security/advisories/GHSA-95j3-435g-vjcp - Vendor Advisory

01 Apr 2025, 20:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4
CWE CWE-79
Summary
  • (es) La vulnerabilidad de Cross Site Scripting en Leantime v3.2.1 y anteriores permite que un atacante autenticado ejecute código arbitrario y obtenga información confidencial a través del campo de nombre en processMentions().

28 Mar 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-28 21:15

Updated : 2025-04-07 14:42

NVD link : CVE-2025-28254

Mitre link : CVE-2025-28254

CVE.ORG link : CVE-2025-28254

JSON object : View

Products Affected

leantime

  • leantime
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')