CVE-2025-43812 MEDIUM

CVE-2025-43812

Vendor Liferay
Product Portal
Weakness CWE-79 · XSS
Published September 29, 2025
Last update September 30, 2025
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a web content structure's Name text field

Key dates

02Disclosure timeline

September 29, 2025 CVE published
September 30, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-43754 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) CVE-2026-33683 AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field CVE-2024-32535 WordPress Access Category Password plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2023-31145 Reflected XSS vulnerability in CollaboraOnline CVE-2025-24967 Stored XSS on Admin Panel When Deleting a User in reNgine