Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-43779

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_commerce_product_definitions_web_internal_portlet_CPDefinitionsPortlet_productTypeName parameter. This malicious payload is then reflected and executed within the user's browser.

Published

2025-09-24T01:15:30.753

Last Modified

2025-12-15T18:19:33.093

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 6.1 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-79
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application liferay digital_experience_platform < 2024.Q1.19 Yes
Application liferay digital_experience_platform 7.4 Yes
Application liferay liferay_portal < 7.4.3.113 Yes
References