Cross-site Scripting (XSS)

Liferay Portal is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input validation because the application fails to sanitize the referer or FORWARDURL parameters, allowing attackers to inject JavaScript using %00...

CVE-2025-43770

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated...

PT-2022-19337 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.1 through 7.4.2 Liferay DXP versions 7.0 fix pack 91 through 101 Liferay DXP versions 7.1 fix pack 17 through 25 Liferay DXP versions 7.2 fix pack 5 through 14 Liferay DXP version 7.3 before service pack 3...