CVE-2025-7739

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allowed authenticated users to achieve stored cross-site scripting by injecting malicious HTML content in scoped label descriptions.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 18.2, < 18.2.2

References

https://gitlab.com/gitlab-org/gitlab/-/issues/556111Broken Link
https://hackerone.com/reports/3255849Permissions Required

Timeline

Published: Aug 13, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-77408.8Default credentials vulnerability exists in SuprOS product. If exploited, this could allow an authenticated local attacker to use an admin a CVE-2025-77412.1Hardcoded Password Vulnerability have been found in CENTUM. Affected products contain a hardcoded password for the user account (PROG) used CVE-2025-77428.3An authentication vulnerability exists in the LG Innotek camera model LNV5110R firmware that allows a malicious actor to upload an HTTP POST CVE-2025-77439.6Cleartext Transmission of Sensitive Information vulnerability in Dolusoft Omaspot allows Interception, Privilege Escalation. This issue aff CVE-2025-77449.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dolusoft Omaspot allows SQL Injection.CVE-2025-77455.8Buffer Over-read vulnerability in ABB AC500 V2.This issue affects AC500 V2: through 2.5.2.CVE-2025-77465.3CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvali CVE-2025-77478.8A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. This affects the function fromWizardHandle of the file /goform CVE-2025-77483.5A vulnerability classified as problematic was found in ZCMS 3.6.0. This vulnerability affects unknown code of the component Create Article P CVE-2025-77499.8A vulnerability, which was classified as critical, has been found in code-projects Online Appointment Booking System 1.0. This issue affects CVE-2025-77509.8A vulnerability, which was classified as critical, was found in code-projects Online Appointment Booking System 1.0. Affected is an unknown CVE-2025-77519.8A vulnerability has been found in code-projects Online Appointment Booking System 1.0 and classified as critical. Affected by this vulnerabi