TI-2025-20765 Aliases CVE-2025-28254 GHSA-95j3-435g-vjcp

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated…

LOW 24CWE-79Published 2025-03-28 · Updated 2025-04-01

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00334 26th percentileScored 2026-11-07

Fix Fixed leantime/leantime (Packagist): 3.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	leantime/leantime (Packagist)	before 3.3	3.3	Patch available	GHSA-95j3-435g-vjcp

— Vendor— Affected all versions Fixed in — No fix listed CNA
leantime/leantime (Packagist) Vendor— Affected before 3.3 Fixed in 3.3 Patch available GHSA-95j3-435g-vjcp

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:leantime:leantime::::::::	before 3.3.0	Vulnerable	Leantime

cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:* Versions before 3.3.0 Vulnerable ·Leantime

Remediation

Fix · GHSA-95j3-435g-vjcp leantime/leantime (Packagist) Fixed in 3.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-28254
2026-10-03 Alias added: GHSA-95j3-435g-vjcp

References

Patch 1

https://github.com/Leantime/leantime/commit/ce1d2073e4601183e1bdd90f4b433d16aee46a50

Advisory 2

Other 2

TI-2024-18279 Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). CVSS 3.1HIGH 8.8
TI-2024-18354 Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute… CVSS 3.1HIGH 7.6
TI-2024-18353 Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute… CVSS 3.1MEDIUM 5.4
TI-2024-18280 Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket. CVSS 3.1MEDIUM 4.7
TI-2023-16829 Leantime Stored Cross-site Scripting Vulnerability CVSS 3.1HIGH 8.9
TI-2020-04348 Time-based blind injection in Leantime CVSS 3.1HIGH 8.8

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences