Description

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the frontend-editor-ckeditor-web/ckeditor/samples/old/ajax.html path

Remediation

References

CVE-2025-43761

Related Vulnerabilities

Atlassian Confluence CVE-2023-22505 Vulnerability (CVE-2023-22505)

MyBB URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2019-20225)

WordPress Plugin Preview E-mails for WooCommerce Cross-Site Scripting (1.6.8)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-7866)

WordPress Plugin Video Conferencing with Zoom Information Disclosure (3.8.16)

Severity

Medium

Classification

CVE-2025-43761 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities