{"action":"Upgrade leantime/leantime to 3.3 or later.","affected":[{"fixed":"3.3","introduced":"0"}],"component":"leantime/leantime","cve_ids":["CVE-2025-28254"],"ecosystem":"Packagist","epss":0.00334,"exploited":false,"fixed_versions":["3.3"],"ghsa_id":"GHSA-95j3-435g-vjcp","id":"tcs_01M5KEZPA4B3537J6PVDT5V1G0","modified_at":"2025-03-31T16:59:49.593601Z","published_at":"2025-02-21T23:54:26Z","references":["https://osv.dev/vulnerability/GHSA-95j3-435g-vjcp","https://github.com/Leantime/leantime/security/advisories/GHSA-95j3-435g-vjcp","https://nvd.nist.gov/vuln/detail/CVE-2025-28254","https://github.com/Leantime/leantime/commit/ce1d2073e4601183e1bdd90f4b433d16aee46a50","https://github.com/Leantime/leantime","https://github.com/Leantime/leantime/blob/0e7ddbbe3d582f657a1dddfef7b3419ae588cbf7/app/Domain/Notifications/Services/Notifications.php#L128"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-95j3-435g-vjcp","url":"https://osv.dev/vulnerability/GHSA-95j3-435g-vjcp"}],"summary":"Leantime affected by Improper Neutralization of HTML Tags"}