CVE-2025-62263

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
4.8MEDIUM
EPSS
0.0%
top 91.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Liferay PortalLiferay DXPLiferay Portal+1 more
Timeline
PublishedOct 27

Description

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 service pack 3 through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account Role’s “Title” text field to (1) view account role page, or (2) select account role page. Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, an…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages5 packages

▶NVDliferay/liferay_portal7.3.7 — 7.4.3.104
▶CVEListV5liferay/portal7.3.7 — 7.4.3.103
▶CVEListV5liferay/dxp7.3.10-sp3 — 7.3.10-u36+2

🔴Vulnerability Details

3
CVEList
CVE-2025-62263: Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7↗2025-10-27
▶
GHSA
Liferay Portal Vulnerable to Cross-Site Scripting↗2025-10-27
▶
OSV
Liferay Portal Vulnerable to Cross-Site Scripting↗2025-10-27
▶
CVE-2025-62263 (MEDIUM CVSS 4.8) | Multiple cross-site scripting (XSS) | cvebase.io