Security Advisory

CVE-2025-43737

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2025-08-19 18:13:04

Last updated 2025-08-19 18:33:43

Assigner Liferay

State PUBLISHED

Description

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote authenticated user to inject JavaScript code via _com_liferay_journal_web_portlet_JournalPortlet_backURL parameter.

← Browse all CVEs View on cve.org ↗