VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Sep 24, 2025· Updated Jun 17, 2026

CVE-2025-43779

CVE-2025-43779

Description

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_commerce_product_definitions_web_internal_portlet_CPDefinitionsPortlet_productTypeName parameter. This malicious payload is then reflected and executed within the user's browser.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7
  • Liferay/Digital Experience Platform2 versions
    cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*range: >=2024.Q1.1,<2024.Q1.19
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:*:*:*:*:*:*:*
  • Liferay/Portal2 versions
    cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*range: >=7.4.0,<7.4.3.113
    • (no CPE)range: 7.4.0
  • Liferay/Liferay Portal Serverllm-fuzzy
    Range: 7.4.0 - 7.4.3.112
  • Liferay/Liferayllm-fuzzy
    Range: 2024.Q1.1 - 2024.Q1.18, 7.4 GA - update 92
  • Liferay/DXPcpe-rescue
    Range: 7.4.13

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.