| Package | Affected versions | Patched versions |
|---|---|---|
| com.liferay:com.liferay.journal.web | < 5.0.196 | 5.0.196 |
| digital experience platform | ≥ 2025.Q1.0, < 2025.Q1.16≥ 2025.Q2.0, < 2025.Q2.9 | 2025.Q1.162025.Q2.9 |
| liferay portal | ≥ 7.4.0, ≤ 7.4.3.132 |
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote authenticated user to inject JavaScript code via _com_liferay_journal_web_portlet_JournalPortlet_backURL parameter.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free