Description

Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via remote app title field.

Remediation

References

CVE-2025-43775

Related Vulnerabilities

WordPress Plugin UpdraftPlus WordPress Backup Privilege Escalation (1.23.2)

WordPress Plugin Car Seller-Auto Classifieds Script SQL Injection (2.1.0)

WordPress Plugin WP eCommerce Multiple Unspecified Vulnerabilities (3.9.3)

Apache Traffic Server Deserialization of Untrusted Data Vulnerability (CVE-2026-58163)

SharePoint Improper Input Validation Vulnerability (CVE-2019-1257)

Severity

Medium

Classification

CVE-2025-43775 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities