Description
Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Commerce Product's Name text field.
Remediation
References
Related Vulnerabilities
LimeSurvey Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2021-44967)
WordPress Plugin Digg Digg Cross-Site Request Forgery (5.3.4)
MySQL CVE-2015-4791 Vulnerability (CVE-2015-4791)
MySQL CVE-2013-2395 Vulnerability (CVE-2013-2395)
Joomla Improper Input Validation Vulnerability (CVE-2018-11321)