Stored Cross-Site Scripting Vulnerability in Liferay Portal and DXP Products

CVE-2025-43778

What is CVE-2025-43778?

A Stored Cross-Site Scripting vulnerability exists in specific versions of Liferay Portal and DXP, allowing remote authenticated attackers to inject malicious JavaScript code through the fieldset name in Kaleo Forms Admin. This injected payload can be stored and executed without appropriate sanitization or escaping, posing a significant risk to the application's integrity and user security. It is crucial for users of the affected versions to implement security measures to mitigate potential exploitation.

References