Stored Cross-Site Scripting Vulnerability in Liferay Portal and DXP

CVE-2025-43787

What is CVE-2025-43787?

A stored cross-site scripting vulnerability exists in the Liferay Portal and Liferay DXP that allows remote authenticated attackers to inject malicious JavaScript through organization site names. The payload is stored on the server and executed in users' browsers without proper sanitization, potentially leading to unauthorized actions or data theft. This vulnerability affects multiple versions of Liferay Portal and DXP, emphasizing the need for immediate attention to secure web applications against such threats.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References