CVE-2025-48869 Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control

Horilla is a free and open source Human Resource Management System HRMS. Unauthenticated users can access uploaded resume files in Horilla 1.3.0 by directly guessing or predicting file URLs. These files are stored in a publicly accessible directory, allowing attackers to retrieve sensitive...

GitLab: Know whether private project name exists or not within a group using link comments

Summary: Hello, It is possible for anyone to know if private project exists or not in public/private groups if they can guess the project names correctly. Description: Using markdown feature, we can form a comment which will allow us to know if the private project is exists within a group or not...