CVE-2025-62240

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
4.8MEDIUM
EPSS
0.0%
top 91.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Digital Experience PlatformLiferay Liferay PortalLiferay DXP+1 more
Timeline
PublishedOct 9

Description

Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 update 35 through update 92, and 7.3 update 25 through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle Name or (3) Last Name text field.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages5 packages

▶NVDliferay/liferay_portal7.4.3.35 — 7.4.3.112
▶Mavencom.liferay:com.liferay.calendar.web5.0.45 — 5.0.88
▶CVEListV5liferay/portal7.4.3.35 — 7.4.3.111
▶NVDliferay/digital_experience_platform2023.Q3.1 — 2023.Q3.8+3
▶CVEListV5liferay/dxp7.3.10-u25 — 7.3.10-u36+3

🔴Vulnerability Details

3
CVEList
CVE-2025-62240: Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7↗2025-10-09
▶
GHSA
Liferay Portal is vulnerable to XSS through its Calendar Events parameters↗2025-10-09
▶
OSV
Liferay Portal is vulnerable to XSS through its Calendar Events parameters↗2025-10-09
▶
CVE-2025-62240 (MEDIUM CVSS 4.8) | Multiple cross-site scripting (XSS) | cvebase.io