CVE-2025-43771
Published: Oct 8, 2025
Modified: Oct 8, 2025
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.10 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into (1) a user’s “First Name” text field, (2) a user’s “Middle Name” text field, (3) a user’s “Last Name” text field, (4) the “Other Reason” text field when flagging content, or (5) the name of the flagged content.
| Vendor | Product | Versions |
|---|---|---|
Liferay | Portal | affected 7.4.3.102 - <= 7.4.3.111 |
Liferay | DXP | affected 2023.Q3.1 - <= 2023.Q3.10affected 2023.Q4.0 - <= 2023.Q4.5 |
Weaknesses (CWE)
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now