Description

Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92 allow remote attackers to inject arbitrary web script or HTML via crafted payload injected into a Terms and Condition's Name text field to (1) Payment Terms, or (2) the Delivery Term on the view order page.

Remediation

References

CVE-2025-43822

Related Vulnerabilities

WordPress Plugin Tutor LMS-eLearning and online course solution Cross-Site Scripting (1.9.10)

PostgreSQL Heap-based Buffer Overflow Vulnerability (CVE-2026-14669)

CubeCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2009-4060)

SharePoint Stack-based Buffer Overflow Vulnerability (CVE-2026-55055)

WordPress Plugin iPanorama 360 WordPress Virtual Tour Builder Cross-Site Scripting (1.6.21)

Severity

Medium

Classification

CVE-2025-43822 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities