Description

Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form with a rich text type field.

Remediation

References

CVE-2025-43830

Related Vulnerabilities

Backbone.js Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-10537)

WordPress Plugin Simple Gmail Login Stack Trace Information Disclosure (1.1.3)

Oracle Database Server CVE-2009-1019 Vulnerability (CVE-2009-1019)

WordPress Plugin Import all XML, CSV & TXT into WordPress Unspecified Vulnerability (3.7.2)

MySQL Cleartext Transmission of Sensitive Information Vulnerability (CVE-2017-3305)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2025-43830