CVE-2025-43811

Multiple stored cross-site scripting XSS vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.7, and 7.4 update 50 through update 92 allows remote authenticated attackers to inject arbitrar...

CVE-2025-43811

Multiple stored cross-site scripting XSS vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.7, and 7.4 update 50 through update 92 allows remote authenticated attackers to inject arbitrar...

CVE-2025-43811

Multiple stored cross-site scripting XSS vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.7, and 7.4 update 50 through update 92 allows remote authenticated attackers to inject arbitrar...

CVE-2025-43811

Multiple stored cross-site scripting XSS vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.7, and 7.4 update 50 through update 92 allows remote authenticated attackers to inject arbitrar...

CVE-2025-43811

Summary (validated): CVE-2025-43811 describes stored XSS in Liferay Portal/DXP via the related asset selector, allowing remote authenticated users to inject scripts by crafting payloads into the asset author’s First/Middle/Last Name fields. Affected products include Liferay Portal 7.4.3.50–7.4.3....

CISA and UK NCSC Release Joint Guidance for Securing OT Systems

CISA, in collaboration with the Federal Bureau of Investigation, the United Kingdom’s National Cyber Security Centre, and other international partners has released new joint cybersecurity guidance: Creating and Maintaining a Definitive View of Your Operational Technology OT Architecture. Building...

Accelerate Crypto Success: Why a Canadian Crypto License Is Your Launchpad to Growth

As the digital asset market matures and regulators worldwide work to set clear standards, one fact has become…...

Liferay Portal和Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

CVE-2025-43811: Improper Neutralization of Input During Web Page Generation

Multiple stored cross-site scripting XSS vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.7, and 7.4 update 50 through update 92 allows remote authenticated attackers to inject arbitrar...

PT-2025-39906

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.3.50 through 7.4.3.111 Liferay DXP versions 2023.Q3.1 through 2023.Q3.7 Liferay DXP versions 2023.Q4.0 through 2023.Q4.4 Liferay DXP 7.4 update 50 through update 92 Description The software contains multiple stored...

Exploit for Code Injection in Craftcms Craft_Cms

CraftCMS CVE-2025-32432 Vulnerability Exploitation Tool Set A...

Cross-site Scripting (XSS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper input validation in the process responsible for handling user-supplied data. An attacker can execute arbitrary scripts in the context o...

IBM Maximo Asset Management Unauthorized Access Info Disclosure

The vulnerability of the IBM Maximo Asset Management software system for managing corporate assets is related to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...

CISA Releases Nine Industrial Control Systems Advisories

CISA released nine Industrial Control Systems ICS advisories on September 18, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-261-01 Westermo Network Technologies WeOS 5 ICSA-25-261-02 Westermo Network...

GLPI Privilege Escalation

The vulnerability of software for asset management and GLPI data centers is related to improper management of privileges. Exploiting this vulnerability can allow a remote attacker to enhance their privileges...

Navigating SEBI’s Cloud Security Requirements: A Guide for Regulated Entities

Overview: Who is impacted: The Securities and Exchange Board of India SEBI is the primary regulatory authority for the securities market in India. It was established to protect investor interests and promote market development, but its guidelines also impact cybersecurity professionals at regulat...

MAL-2025-47143 Malicious code in @ctrl/transmission (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 373adf918ca34b44f43aa8ac4605a9ea8700867194e71bbbeef53aad48b3b593 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Bulletproof Host Stark Industries Evades EU Sanctions

In May 2025, the European Union levied financial sanctions on the owners ofStark Industries Solutions Ltd. , a bulletproof hosting provider that materialized two weeks before Russia invaded Ukraine and quickly became a top source of Kremlin-linked cyberattacks and disinformation campaigns. But ne...

Cross-site Scripting (XSS)

Liferay Portal is vulnerable to Cross-site Scripting XSS. The vulnerability is due to insufficient input sanitization due to improper handling of the comliferayusersadminwebportletUsersAdminPortletassetTagNames parameter, allowing remote authenticated attackers to inject JavaScript...

ROS-20250911-12

Vulnerabilities in GLPI's asset management and data center management software are related to improper privilege management. Exploitation of the vulnerability could allow an attacker acting remotely to escalate privileges...