QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2025-3760

Back to search

CVE-2025-3760

Published: Apr 17, 2025

Modified: Sep 4, 2025

PUBLISHED

Description

A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page.

VendorProductVersions

Liferay

Portal

affected
7.2.0 - <= 7.4.3.129

Liferay

DXP

affected
7.2.10 - <= dxp-20
affected
7.3.10 - <= 7.3.10-u36
affected
7.4.13 - <= 7.4.13-u92
affected
2023.Q3.1 - <= 2023.Q3.10
affected
2023.Q4.0 - <= 2023.Q4.10

+4 more versions

Weaknesses (CWE)

CWE-79

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now