Description
A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.
Remediation
References
Related Vulnerabilities
WordPress Plugin MarketPress-WordPress eCommerce PHP Object Injection (3.2.6)
WordPress Plugin Feed Them Social-for Twitter feed, Youtube and more PHAR Deserialization (2.9.8.5)
WebLogic CVE-2023-21956 Vulnerability (CVE-2023-21956)
WordPress Plugin Unlimited PopUps SQL Injection (4.5.3)
WordPress Plugin Image Widget Unspecified Vulnerability (4.1.2)