CVE-2025-28254

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 28, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-282569.8An issue in TOTOLINK A3100R V4.1.2cu.5247_B20211129 allows a remote attacker to execute arbitrary code via the setWebWlanIdx of the file /liCVE-2025-28262.6n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL eCVE-2025-28274.3IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 could disclose sensitive installation directory informCVE-2025-282810.0A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically,CVE-2025-28297.8A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocCVE-2025-28306.3By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory lisCVE-2025-28319.8A vulnerability has been found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified asCVE-2025-28324.3A vulnerability was found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as probCVE-2025-28335.3A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function of the coCVE-2025-283437.5striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function ThreadReadButtons.CVE-2025-283447.5striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function AuxJack.CVE-2025-28354.3A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is the funct