CVE-2025-28254

Katalog CVE

CVSS 5.4 · Medium EPSS 0,33%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada leantime. Skor CVSS 3.1 5.4 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().

Rincian

Terbit di NVD

28 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 25,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Leantime/leantime/security/advisories/GHSA-95j3-435g-vjcp advisory vendor
• https://github.com/Leantime/leantime/commit/ce1d2073e4601183e1bdd90f4b433d16aee46a50 patch
• https://github.com/Leantime/leantime/blob/0e7ddbbe3d582f657a1dddfef7b3419ae588cbf7/app/Domain/Notifications/Se... product