Description

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the text field from a web content.

Remediation

References

CVE-2025-43765

Related Vulnerabilities

WordPress Plugin Radio Buttons for Taxonomies Cross-Site Request Forgery (2.0.5)

Oracle Database Server CVE-2012-3134 Vulnerability (CVE-2012-3134)

Masa CMS Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2024-32641)

WordPress Plugin DP Thumbnail TimThumb Arbitrary File Upload (1.0)

Rukovoditel Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-13590)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2025-43765