CVE-2025-62238

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
4.8MEDIUM
EPSS
0.0%
top 91.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Digital Experience PlatformLiferay Liferay PortalLiferay DXP+1 more
Timeline
PublishedOct 10

Description

Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via a crafted payload injected into a Account's “Name“ text field.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages5 packages

▶NVDliferay/liferay_portal7.4.3.21 — 7.4.3.112
▶CVEListV5liferay/portal7.4.3.21 — 7.4.3.111
▶NVDliferay/digital_experience_platform2023.q3.1 — 2023.q3.9+2
▶CVEListV5liferay/dxp7.4.13-u21 — 7.4.13-u92+2

🔴Vulnerability Details

3
CVEList
CVE-2025-62238: Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7↗2025-10-10
▶
OSV
Liferay Portal's Membership page is vulnerable to XSS through “name“ text field↗2025-10-10
▶
GHSA
Liferay Portal's Membership page is vulnerable to XSS through “name“ text field↗2025-10-10
▶
CVE-2025-62238 (MEDIUM CVSS 4.8) | Stored cross-site scripting (XSS) v | cvebase.io