Low severityNVD Advisory· Published Aug 18, 2025· Updated Aug 18, 2025
CVE-2025-43733
CVE-2025-43733
Description
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated attacker to inject JavaScript code via the content page's name field. This malicious payload is then reflected and executed within the user's browser when viewing the "document View Usages" page.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.liferay:com.liferay.layout.taglibMaven | < 17.0.0 | 17.0.0 |
Affected products
3Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-vhcr-hgc8-29qrghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-43733ghsaADVISORY
- github.com/liferay/liferay-portal/commit/2135a88adb8c7f1a6cb4fbd768fef3b08953a50cghsaWEB
- liferay.atlassian.net/browse/LPE-18218ghsaWEB
- liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43733ghsaWEB
News mentions
0No linked articles in our index yet.