← CVE Intelligence

CVE-2025-43826

Liferay / Portal PUBLISHED

Description (CNA)

Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allow remote attackers to inject arbitrary web script or HTML via any rich text field in a web content article.

Affected (CNA)

Vendor / productVersions
Liferay / Portalaffected 7.4.0 through 7.4.3.112
Liferay / DXPaffected 7.4.13 through 7.4.13-u92; affected 2023.Q3.1 through 2023.Q3.10; affected 2023.Q4.0 through 2023.Q4.8; affected 2024.Q1.1 through 2024.Q1.2

CWE

CWE-79

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.