CVE-2025-43774
nonerejectedpriority · track · 0DEEUUSRejected reason: This CVE ID is rejected. The reported vulnerability was found to be present only in a feature that was under development and protected by a beta feature flag. As a result, the issue was not exploitable in the official or public releases within the specified affected ranges, making this a false positive for officially released versions.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (7)
Products and version ranges known to be affected.
- Maven com.liferay:com.liferay.frontend.taglib.clay< 15.2.1osvUSpkg:maven/com.liferay/com.liferay.frontend.taglib.clay
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-1990Liferay Portal: Mehrere SchwachstellenDeutsch2025-09-08csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um Informationen offenzulegen oder einen Cross Site Scripting Angriff durchzuführen.
- GHSA-qgj5-4qvg-2f8cLiferay Portal is vulnerable to XSS attack through its Style Book theme2025-09-09ghsa · osvUS
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.17 allows a remote authenticated user to inject JavaScript code via Style Book theme name. This malicious payload is then reflected and executed within the user's browser.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (1) cnnvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan