Reflected Cross-Site Scripting Vulnerability in Liferay Portal and DXP

CVE-2025-43733

What is CVE-2025-43733?

A reflected cross-site scripting (XSS) vulnerability exists in specific versions of Liferay Portal and Liferay DXP, allowing an authenticated attacker to inject malicious JavaScript into the content page's name field. When the affected content is viewed on the 'document View Usages' page, the injected script is executed in the browser of users, potentially leading to unauthorized actions and data exposure.

References