Description XSS exists in Liferay Portal before 7.0 CE GA4(7.0.3) via a login name, password, or e-mail address. Remediation References CVE-2017-12646 Related Vulnerabilities Magento Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2021-28566) Drupal Core 7.x Multiple Vulnerabilities (7.0 - 7.17) Apache Tomcat Untrusted Search Path Vulnerability (CVE-2025-49124) Envoy Proxy Excessively Deep Nesting Vulnerability (CVE-2026-48042) PHP Out-of-bounds Read Vulnerability (CVE-2019-9023) Severity Medium Tags Missing Update Known Vulnerabilities CWE-707 CVE-2017-12646