CVE-2025-62240
published 2025-10-09CVE-2025-62240: Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through…
PriorityP425medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.21%
10.6th percentile
Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 update 35 through update 92, and 7.3 update 25 through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle Name or (3) Last Name text field.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | >= 2023.Q3.1 < 2023.Q3.8 | 2023.Q3.8 |
| liferay | digital_experience_platform | >= 2023.q4.0 < 2023.q4.6 | 2023.q4.6 |
| liferay | dxp | 2023.Q3.1 – 2023.Q3.7 | — |
| liferay | dxp | 2023.Q4.0 – 2023.Q4.5 | — |
| liferay | dxp | 7.3.10-u25 – 7.3.10-u36 | — |
| liferay | dxp | 7.4.13-u35 – 7.4.13-u92 | — |
| liferay | liferay_portal | >= 7.4.3.35 < 7.4.3.112 | 7.4.3.112 |
| liferay | portal | 7.4.3.35 – 7.4.3.111 | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv4.04.8MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Liferay Portal is vulnerable to XSS through its Calendar Events parameters
ghsa·2025-10-09
CVE-2025-62240 [MEDIUM] CWE-79 Liferay Portal is vulnerable to XSS through its Calendar Events parameters
Liferay Portal is vulnerable to XSS through its Calendar Events parameters
Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 update 35 through update 92, and 7.3 update 25 through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle Name or (3) Last Name text field.
OSV
Liferay Portal is vulnerable to XSS through its Calendar Events parameters
osv·2025-10-09
CVE-2025-62240 [MEDIUM] Liferay Portal is vulnerable to XSS through its Calendar Events parameters
Liferay Portal is vulnerable to XSS through its Calendar Events parameters
Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 update 35 through update 92, and 7.3 update 25 through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle Name or (3) Last Name text field.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-09
Published