Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-43735 · ADVISORY
• liferay/liferay-portal commit 64d19e4 · WEB
• liferay/liferay-portal · PACKAGE
• liferay.atlassian.net/browse/LPE-18158 · WEB
• liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43735 · WEB

Altre vulnerabilità di com.liferay.portal:com.liferay.portal.impl

• CVE-2025-62276MEDIO 5.5The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay D…
• CVE-2025-62261MEDIO 6.5Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92…
• CVE-2025-62254ALTO 7.5The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 202…
• CVE-2025-62249MEDIO 6.1A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q…
• CVE-2025-62252MEDIO 4.3Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay…