Cross-site Scripting

Liferay Portal is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input sanitization in the /c/portal/comment/discussion/geteditor endpoint, allowing attackers to inject and execute arbitrary web scripts in a victim’s browser...

CVE-2025-43783

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML vi...

PT-2025-37097

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.73 through 7.4.3.128 Liferay DXP versions 2024.Q3.0 through 2024.Q3.1 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q1.1 through 2024.Q1.12 Liferay versions 7.4 update 73 through...