CVE-2025-43786 MEDIUM

CVE-2025-43786

Vendor Liferay
Product Portal
Weakness CWE-79 · XSS
Published September 9, 2025
Last update September 10, 2025
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 and 7.4 GA through update 92 allow attackers to determine existent ERC in the application by exploit the time response.

Key dates

02Disclosure timeline

September 9, 2025 CVE published
September 10, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-9873 a3 Lazy Load <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-64208 WordPress Jannah - Extensions plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability CVE-2024-11898 Scratch & Win – Giveaways and Contests <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-51488 WordPress Crowdsignal Dashboard – Polls, Surveys & more Plugin <= 3.0.11 is vulnerable to Cross Site Scripting (XSS) CVE-2026-3610 HSC Cybersecurity Mailinspector URL mliUserValidation.php cross site scripting