CVE-2025-43807

A stored XSS was reported in Liferay Portal and Liferay DXP via the notifications widget. A crafted payload placed in a publication’s Name field can execute arbitrary script in affected users’ browsers. Affected are Liferay Portal 7.4.0–7.4.3.112 and Liferay DXP 2023.Q4.0–2023.Q4.8, 2023.Q3.1–202...

CVE-2025-43807: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting XSS vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted...

PT-2025-38739

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.112 Liferay DXP versions 2023.Q4.0 through 2023.Q4.8 Liferay DXP versions 2023.Q3.1 through 2023.Q3.10 Liferay DXP versions 7.4 GA through update 92 Description A stored cross-site scripting XSS issu...