Description
Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an attachment's filename.
Remediation
References
Related Vulnerabilities
WordPress Plugin Blog2Social:Social Media Auto Post & Scheduler Cross-Site Scripting (5.0.2)
Jenkins Improper Authentication Vulnerability (CVE-2017-1000354)
WordPress Plugin WP DoNotTrack Cross-Site Scripting (0.8.8)
WordPress Plugin Ultimate Membership Pro SQL Injection (6.4)
Moodle Improper Encoding or Escaping of Output Vulnerability (CVE-2021-40694)