Reflected XSS Vulnerability in Liferay Portal and Liferay DXP

CVE-2025-62248

What is CVE-2025-62248?

A reflected cross-site scripting (XSS) vulnerability has been detected in multiple versions of Liferay Portal and Liferay DXP. This issue arises from a regression that enables remote, authenticated attackers to inject malicious JavaScript code through a crafted parameter. When a victim accesses a specially constructed URL containing the harmful input, the malicious payload gets executed in their browser, potentially leading to unauthorized access and manipulation of sensitive user data.

References