Stored Cross-Site Scripting Vulnerability in Liferay Portal and Liferay DXP

CVE-2025-43775

What is CVE-2025-43775?

A stored cross-site scripting vulnerability exists in Liferay Portal versions 7.4.0 to 7.4.3.128 and Liferay DXP versions 2024.Q1.1 to 2024.Q3.5. This flaw allows remote attackers to inject malicious web scripts or HTML code through the remote app title field. Exploiting this vulnerability could lead to unauthorized actions performed on behalf of users, enabling attackers to compromise user accounts and data integrity, making it crucial for organizations to patch their installations promptly.

References