Cross Site Scripting Vulnerability in Leantime Project Management Software
CVE-2025-28254

Currently unrated

Key Information:

Vendor: Leantime
Status: Leantime Project Management Software
Vendor: CVE Published:; 28 March 2025

What is CVE-2025-28254?

A Cross Site Scripting (XSS) vulnerability exists in Leantime project management software versions 3.2.1 and earlier. Authenticated attackers can exploit this flaw via the 'first name' field in the processMentions() function, leading to the execution of arbitrary code and the potential exposure of sensitive information. This vulnerability highlights the importance of sanitizing user inputs to protect against code injection and data breaches.

References

https://github.com/Leantime/leantime/blob/0e7ddbbe3d582f6...

https://github.com/Leantime/leantime/commit/ce1d2073e4601...

https://github.com/Leantime/leantime/security/advisories/...

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Mar 28, 2025
Vulnerability Reserved
Mar 11, 2025

CVE-2025-28254 Data

JSON