Cross-Site Scripting Flaw in Liferay Portal and DXP

CVE-2025-62240

What is CVE-2025-62240?

Multiple cross-site scripting (XSS) vulnerabilities present in Liferay Portal versions 7.4.3.35 to 7.4.3.111 and Liferay DXP versions 2023.Q4.0 to 2023.Q4.5, among others, can allow remote attackers to inject arbitrary web scripts or HTML. This injection can occur through user-supplied data in fields such as First Name, Middle Name, or Last Name, potentially compromising user information and elevating security risks. It is crucial for users and administrators to apply available security patches to mitigate the risk associated with these vulnerabilities.

References