CVE-2025-5069

MediumCVSS 6.5/10Last modified Oct 19, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name to the victim's project.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-708

Affected software

No affected versions have been published.

Timeline

Published: Sep 26, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-506906.1A Cross-Site Scripting (XSS) vulnerability exists in SpatialReference.org (OSGeo/spatialreference.org) versions prior to 2025-05-17 (commit CVE-2025-506915.3MCSManager 10.5.3 daemon process runs as a root account by default, and its sensitive data (including tokens and terminal content) is stored CVE-2025-506929.8FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/template_file/editFile.html.CVE-2025-506936.5PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Insecure Direct Object Reference (IDOR) in odms/request-details.php.CVE-2025-506956.1PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in /admin/view-booking-detail.php and /admin/CVE-2025-506996.1PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in odms/admin/view-user-queries.php.CVE-2025-507069.8An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function CVE-2025-507079.8An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component CVE-2025-507087.5An issue in Perplexity AI GPT-4 v.2.51.0 allows a remote attacker to obtain sensitive information via the token component in the shared chat CVE-2025-507094.3An issue in Perplexity AI GPT-4 allows a remote attacker to obtain sensitive information via a GET parameter CVE-2025-50718.8The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on CVE-2025-50725.3Resource leak vulnerability in ASR180x、ASR190x in con_mgr allows Resource Leak Exposure.This issue affects Falcon_Linux、Kestrel、Lapwing_Linu