Stored Cross-Site Scripting Vulnerability in Liferay Portal and DXP

CVE-2025-43769

What is CVE-2025-43769?

A stored cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.131 and in Liferay DXP across multiple versions. This flaw enables remote attackers to inject arbitrary web scripts or HTML through the components tab, potentially compromising the integrity of the web application and the data it handles. Organizations using affected versions are advised to implement necessary security updates to mitigate risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References