ByteOS

Product

Portal

Default Status

unaffected

Versions

Affected

From 7.4.3.41 through 7.4.3.52 (maven)

Vendor

Product

DXP

Default Status

unaffected

Versions

Affected

From 7.4.13.u41 through 7.4.13.u52 (maven)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Version: 3.1

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Hyperlink	Resource
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33941	vendor-advisory

Hyperlink: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33941

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33941	vendor-advisory x_transferred

Hyperlink: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33941

Resource:

vendor-advisory

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security@liferay.com

Published At:24 May, 2023 | 15:15

Updated At:31 May, 2023 | 19:11

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Secondary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Type: Primary

Version: 3.1

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CPE Matches

cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*

>>digital_experience_platform>>7.4

cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*

>>digital_experience_platform>>7.4

cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*

>>liferay_portal>>Versions from 7.4.3.31(inclusive) to 7.4.3.52(inclusive)

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov
CWE-79	Secondary	security@liferay.com

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-79

Type: Secondary

Source: security@liferay.com

References

Hyperlink	Source	Resource
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33941	security@liferay.com	Vendor Advisory

Hyperlink: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33941

Source: security@liferay.com

Resource:

Vendor Advisory

Similar CVEs

9083Records found

CVE-2017-12649

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.25% / 47.81%

7 Day CHG~0.00%

Published-07 Aug, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display.

Vendor-n/a Liferay Inc.

Product-liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-12647

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.25% / 47.81%

7 Day CHG~0.00%

Published-07 Aug, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title.

Vendor-n/a Liferay Inc.

Product-liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-12648

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.25% / 47.81%

7 Day CHG~0.00%

Published-07 Aug, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL.

Vendor-n/a Liferay Inc.

Product-liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-12645

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.49%

7 Day CHG~0.00%

Published-07 Aug, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.

Vendor-n/a Liferay Inc.

Product-liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-26266

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-9||CRITICAL

EPSS-0.20% / 42.19%

7 Day CHG~0.00%

Published-21 Feb, 2024 | 02:32

Updated-28 Jan, 2025 | 02:33

Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before update 10, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the first/middle/last name text field of the user who creates an entry in the (1) Announcement widget, or (2) Alerts widget.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-42114

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.19% / 40.70%

7 Day CHG~0.00%

Published-18 Oct, 2022 | 00:00

Updated-10 May, 2025 | 03:15

A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and Liferay DXP 7.4 before update 37 allows remote attackers to inject arbitrary web script or HTML.

Vendor-n/a Liferay Inc.

Product-liferay_portal dxp n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-42112

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.20% / 42.48%

7 Day CHG~0.00%

Published-18 Oct, 2022 | 00:00

Updated-13 May, 2025 | 18:17

A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.

Vendor-n/a Liferay Inc.

Product-liferay_portal dxp digital_experience_platform n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-42111

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 34.69%

7 Day CHG~0.00%

Published-15 Nov, 2022 | 00:00

Updated-13 May, 2025 | 18:17

A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload.

Vendor-n/a Liferay Inc.

Product-liferay_portal dxp digital_experience_platform n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-25602

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-9||CRITICAL

EPSS-0.15% / 36.51%

7 Day CHG~0.00%

Published-21 Feb, 2024 | 01:45

Updated-28 Jan, 2025 | 21:26

Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into an organization’s “Name” text field

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-42119

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.52% / 66.00%

7 Day CHG~0.00%

Published-15 Nov, 2022 | 00:00

Updated-30 Apr, 2025 | 15:15

Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8.

Vendor-n/a Liferay Inc.

Product-dxp liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-42115

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.19% / 40.70%

7 Day CHG~0.00%

Published-18 Oct, 2022 | 00:00

Updated-13 May, 2025 | 15:15

Cross-site scripting (XSS) vulnerability in the Object module's edit object details page in Liferay Portal 7.4.3.4 through 7.4.3.36 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the object field's `Label` text field.

Vendor-n/a Liferay Inc.

Product-liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-25152

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-9||CRITICAL

EPSS-0.15% / 36.51%

7 Day CHG~0.00%

Published-21 Feb, 2024 | 02:00

Updated-28 Jan, 2025 | 21:26

Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the filename of an attachment.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal digital_experience_platform liferay_portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-25145

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-9.6||CRITICAL

EPSS-0.15% / 36.51%

7 Day CHG~0.00%

Published-07 Feb, 2024 | 14:57

Updated-13 May, 2025 | 18:17

Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application.

Vendor-Liferay Inc.

Product-liferay_portal dxp digital_experience_platform DXP Portal portal dxp

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-25601

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-9||CRITICAL

EPSS-0.15% / 36.51%

7 Day CHG~0.00%

Published-21 Feb, 2024 | 01:54

Updated-28 Jan, 2025 | 21:26

Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the name text field of a geolocation custom field.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-25151

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-5.4||MEDIUM

EPSS-0.36% / 57.68%

7 Day CHG~0.00%

Published-21 Feb, 2024 | 03:17

Updated-28 Jan, 2025 | 02:28

The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user's name. This may lead to a content spoofing or cross-site scripting (XSS) attacks depending on the capability of the receiver's mail client.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-38902

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.10% / 27.92%

7 Day CHG~0.00%

Published-13 Oct, 2022 | 00:00

Updated-15 May, 2025 | 16:15

A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic.

Vendor-n/a Liferay Inc.

Product-liferay_portal dxp n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-3670

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-9.29% / 92.42%

7 Day CHG~0.00%

Published-13 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.

Vendor-n/a Liferay Inc.

Product-liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0178

Matching Score-6

Assigner-CERT/CC

Matching Score-6

Assigner-CERT/CC

CVSS Score-4.3||MEDIUM

EPSS-2.59% / 85.00%

7 Day CHG~0.00%

Published-04 Feb, 2008 | 23:00

Updated-16 Sep, 2024 | 22:25

Cross-site scripting (XSS) vulnerability in the Enterprise Admin Session Monitoring component in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the User-Agent HTTP header.

Vendor-n/a Liferay Inc.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-10404

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.25% / 47.81%

7 Day CHG~0.00%

Published-07 Aug, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted redirect field to modules/apps/foundation/frontend-js/frontend-js-spa-web/src/main/resources/META-INF/resources/init.jsp.

Vendor-n/a Liferay Inc.

Product-liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-43770

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.05% / 13.87%

7 Day CHG~0.00%

Published-23 Aug, 2025 | 01:03

Updated-25 Aug, 2025 | 20:24

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the referer or FORWARD_URL using %00 in those parameters.

Vendor-Liferay Inc.

Product-Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-43755

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-5.1||MEDIUM

EPSS-0.18% / 40.22%

7 Day CHG~0.00%

Published-21 Aug, 2025 | 16:40

Updated-22 Aug, 2025 | 18:08

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.13, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_type parameter.

Vendor-Liferay Inc.

Product-DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0179

Matching Score-6

Assigner-CERT/CC

Matching Score-6

Assigner-CERT/CC

CVSS Score-2.6||LOW

EPSS-0.79% / 72.93%

7 Day CHG~0.00%

Published-04 Feb, 2008 | 23:00

Updated-17 Sep, 2024 | 03:06

Cross-site scripting (XSS) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header, which is used when composing Forgot Password e-mail messages in HTML format.

Vendor-n/a Liferay Inc.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0181

Matching Score-6

Assigner-CERT/CC

Matching Score-6

Assigner-CERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.58% / 67.96%

7 Day CHG~0.00%

Published-04 Feb, 2008 | 23:00

Updated-16 Sep, 2024 | 18:55

Cross-site scripting (XSS) vulnerability in the Admin portlet in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Shutdown message.

Vendor-n/a Liferay Inc.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0180

Matching Score-6

Assigner-CERT/CC

Matching Score-6

Assigner-CERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.58% / 67.96%

7 Day CHG~0.00%

Published-04 Feb, 2008 | 23:00

Updated-16 Sep, 2024 | 23:41

Cross-site scripting (XSS) vulnerability in themes/_unstyled/templates/init.vm in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Greeting field in a User Profile.

Vendor-n/a Liferay Inc.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2004-2030

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.62% / 81.10%

7 Day CHG~0.00%

Published-10 May, 2005 | 04:00

Updated-03 Apr, 2025 | 01:03

Multiple cross-site scripting (XSS) vulnerabilities in index.jsp for Liferay before 2.2.0 release 10/1/2004 allow remote attackers to inject arbitrary web script or HTML, as demonstrated using the message subject.

Vendor-n/a Liferay Inc.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-38267

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.62%

7 Day CHG~0.00%

Published-02 Mar, 2022 | 23:15

Updated-04 Aug, 2024 | 01:37

Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_portlet_BlogsAdminPortlet_title and _com_liferay_blogs_web_portlet_BlogsAdminPortlet_subtitle parameter.

Vendor-n/a Liferay Inc.

Product-digital_experience_platform liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-6173

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-7.50% / 91.41%

7 Day CHG~0.00%

Published-30 Nov, 2007 | 00:00

Updated-07 Aug, 2024 | 15:54

Cross-site scripting (XSS) vulnerability in c/portal/login in Liferay Enterprise Portal 4.3.1 allows remote attackers to inject arbitrary web script or HTML via the emailAddress parameter in a Send New Password action, a different vector than CVE-2007-6055. NOTE: some of these details are obtained from third party information.

Vendor-n/a Liferay Inc.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-6055

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-7.64% / 91.51%

7 Day CHG~0.00%

Published-20 Nov, 2007 | 20:00

Updated-07 Aug, 2024 | 15:54

Cross-site scripting (XSS) vulnerability in c/portal/login in Liferay Portal 4.1.0 and 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the login parameter. NOTE: this issue reportedly exists because of a regression that followed a fix at an unspecified earlier date.

Vendor-n/a Liferay Inc.

Product-portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-33328

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.15% / 35.87%

7 Day CHG~0.00%

Published-03 Aug, 2021 | 18:41

Updated-13 May, 2025 | 18:17

Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the (1) _com_liferay_journal_web_portlet_JournalPortlet_name or (2) _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.

Vendor-n/a Liferay Inc.

Product-liferay_portal digital_experience_platform n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-47795

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-9||CRITICAL

EPSS-0.39% / 59.38%

7 Day CHG~0.00%

Published-21 Feb, 2024 | 14:01

Updated-28 Jan, 2025 | 21:17

Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 18 through 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a document's “Title” text field.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-38265

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.62%

7 Day CHG~0.00%

Published-02 Mar, 2022 | 23:03

Updated-04 Aug, 2024 | 01:37

Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter.

Vendor-n/a Liferay Inc.

Product-digital_experience_platform liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-8349

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.25% / 48.40%

7 Day CHG~0.00%

Published-24 Nov, 2014 | 16:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Liferay Portal Enterprise Edition (EE) 6.2 SP8 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the _20_body parameter in the comment field in an uploaded file.

Vendor-n/a Liferay Inc.

Product-liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-33339

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.8||MEDIUM

EPSS-0.17% / 38.88%

7 Day CHG~0.00%

Published-04 Aug, 2021 | 12:48

Updated-13 May, 2025 | 18:17

Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_admin_web_portlet_SiteAdminPortlet_name parameter.

Vendor-n/a Liferay Inc.

Product-liferay_portal digital_experience_platform n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-28978

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.17% / 38.18%

7 Day CHG~0.00%

Published-21 Sep, 2022 | 23:38

Updated-27 May, 2025 | 19:15

Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.

Vendor-n/a Liferay Inc.

Product-dxp liferay_portal digital_experience_platform n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-2963

Matching Score-6

Assigner-CERT/CC

Matching Score-6

Assigner-CERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.55% / 66.87%

7 Day CHG~0.00%

Published-10 Jul, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Multiple cross-site scripting (XSS) vulnerabilities in group/control_panel/manage in Liferay Portal 6.1.2 CE GA3, 6.1.X EE, and 6.2.X EE allow remote attackers to inject arbitrary web script or HTML via the (1) _2_firstName, (2) _2_lastName, or (3) _2_middleName parameter.

Vendor-n/a Liferay Inc.

Product-liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-44309

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-9||CRITICAL

EPSS-0.16% / 37.03%

7 Day CHG~0.00%

Published-17 Oct, 2023 | 08:23

Updated-13 Sep, 2024 | 16:31

Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay DXP 7.4 before update 54 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into any non-HTML field of a linked source asset.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-44310

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-9||CRITICAL

EPSS-0.15% / 36.51%

7 Day CHG~0.00%

Published-17 Oct, 2023 | 09:28

Updated-13 Sep, 2024 | 16:31

Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-42629

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-9||CRITICAL

EPSS-0.16% / 37.80%

7 Day CHG~0.00%

Published-17 Oct, 2023 | 08:13

Updated-02 Aug, 2024 | 19:23

Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-26593

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.17% / 38.31%

7 Day CHG~0.00%

Published-19 Apr, 2022 | 12:46

Updated-03 Aug, 2024 | 05:03

Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the name of a asset category.

Vendor-n/a Liferay Inc.

Product-digital_experience_platform liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-42627

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-9.6||CRITICAL

EPSS-0.16% / 37.34%

7 Day CHG~0.00%

Published-17 Oct, 2023 | 12:08

Updated-12 Jun, 2025 | 15:09

Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a (1) Shipping Name, (2) Shipping Phone Number, (3) Shipping Address, (4) Shipping Address 2, (5) Shipping Address 3, (6) Shipping Zip, (7) Shipping City, (8) Shipping Region (9), Shipping Country, (10) Billing Name, (11) Billing Phone Number, (12) Billing Address, (13) Billing Address 2, (14) Billing Address 3, (15) Billing Zip, (16) Billing City, (17) Billing Region, (18) Billing Country, or (19) Region Code.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-42628

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-9||CRITICAL

EPSS-0.16% / 37.34%

7 Day CHG~0.00%

Published-17 Oct, 2023 | 11:52

Updated-02 Aug, 2024 | 19:23

Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-7934

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-3.29% / 86.68%

7 Day CHG~0.00%

Published-28 Jan, 2020 | 13:03

Updated-04 Aug, 2024 | 09:48

In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will then be rendered when a user utilizes the search feature to search for other users (i.e., if a user with modified fields occurs in the search results). This issue was fixed in Liferay Portal CE version 7.3.0 GA1.

Vendor-n/a Liferay Inc.

Product-liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-43756

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.22% / 44.24%

7 Day CHG~0.00%

Published-21 Aug, 2025 | 16:19

Updated-22 Aug, 2025 | 18:08

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.15, 2025.Q2.0 through 2025.Q2.2 and 2024.Q1.13 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via snippet parameter.

Vendor-Liferay Inc.

Product-DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-43753

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-2.1||LOW

EPSS-0.20% / 42.10%

7 Day CHG~0.00%

Published-21 Aug, 2025 | 22:23

Updated-22 Aug, 2025 | 18:08

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 update 32 through update 92 allows an remote authenticated user to inject JavaScript into the embedded message field from the form container.

Vendor-Liferay Inc.

Product-Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-43738

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-5.1||MEDIUM

EPSS-0.23% / 45.60%

7 Day CHG+0.02%

Published-19 Aug, 2025 | 15:50

Updated-20 Aug, 2025 | 14:40

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via _com_liferay_expando_web_portlet_ExpandoPortlet_displayType parameter.

Vendor-Liferay Inc.

Product-Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-4599

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-2||LOW

EPSS-0.06% / 17.57%

7 Day CHG~0.00%

Published-04 Aug, 2025 | 21:18

Updated-05 Aug, 2025 | 15:43

The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 update 61 through update 92 was found to be vulnerable to postMessage-based XSS because it allows a remote non-authenticated attacker to inject JavaScript into the fragment portlet URL.

Vendor-Liferay Inc.

Product-Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-43765

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.05% / 13.87%

7 Day CHG~0.00%

Published-23 Aug, 2025 | 04:32

Updated-25 Aug, 2025 | 20:24

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the text field from a web content.

Vendor-Liferay Inc.

Product-Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-4576

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.06% / 19.45%

7 Day CHG~0.00%

Published-08 Aug, 2025 | 15:42

Updated-08 Aug, 2025 | 20:30

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/blogs/blogs-web/src/main/resources/META-INF/resources/blogs/entry_cover_image_caption.jsp

Vendor-Liferay Inc.

Product-DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-43769

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-4.6||MEDIUM

EPSS-0.19% / 40.92%

7 Day CHG~0.00%

Published-23 Aug, 2025 | 02:49

Updated-25 Aug, 2025 | 20:24

Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute arbitrary web script or HTML via components tab.

Vendor-Liferay Inc.

Product-Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-43746

Matching Score-6

Assigner-Liferay, Inc.