CVE-2025-28254

MEDIUM

Leantime < 3.3.0 - Authenticated Stored Cross-Site Scripting via First Name Field in processMentions()

Title source: llm

Description

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().

References (3)

Core 3

Core References

Product

https://github.com/Leantime/leantime/blob/0e7ddbbe3d582f657a1dddfef7b3419ae588cbf7/app/Domain/Notifications/Services/Notifications.php#L128

View Writeup ZIP pw:eip

Patch

https://github.com/Leantime/leantime/commit/ce1d2073e4601183e1bdd90f4b433d16aee46a50

View Patch ZIP pw:eip

Vendor Advisory

https://github.com/Leantime/leantime/security/advisories/GHSA-95j3-435g-vjcp

Scores

CVSS v3 5.4

EPSS 0.0030

EPSS Percentile 21.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (2)

leantime/leantime < 3.3.0

leantime/leantime 0 - 3.3Packagist

Published Mar 28, 2025

Tracked Since Feb 18, 2026