Cross-Site Scripting Vulnerabilities in Liferay Portal and DXP

CVE-2025-43771

What is CVE-2025-43771?

Multiple cross-site scripting vulnerabilities exist in Liferay Portal and DXP, affecting specific versions. Remote attackers can exploit these vulnerabilities by injecting malicious web scripts or HTML through various user-input fields, including the First Name, Middle Name, and Last Name fields, as well as the Other Reason field used for flagging content and the name of flagged content. Proper validation and sanitization of these inputs are crucial to mitigate the risk of unauthorized script injection.

References