Duplicate Advisory: Leantime affected by Improper Neutralization of HTML Tags
Date: 2025-03
Affected: composer/leantime/leantime
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-28254
CWE: CWE-79
CWE-80
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-95j3-435g-vjcp. This link is maintained to preserve external references. ### Original Description Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().


Mitigations:

Architectural layers (MAESTRO):