Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-62249 · ADVISORY
• liferay/liferay-portal commit 66c51e0 · WEB
• liferay/liferay-portal commit 8309d01 · WEB
• liferay/liferay-portal commit f041e70 · WEB
• liferay/liferay-portal · PACKAGE
• liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62249 · WEB

com.liferay.portal:com.liferay.portal.impl 的其他漏洞

• CVE-2025-62276中危 5.5The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay D…
• CVE-2025-62261中危 6.5Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92…
• CVE-2025-62254高危 7.5The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 202…
• CVE-2025-62252中危 4.3Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay…
• CVE-2025-43813高危 8.2Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsuppo…