CVE-2025-43778: 
Java vulnerability analysis and mitigation

A Stored cross-site scripting vulnerability (CVE-2025-43778) was discovered in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP versions from 2024.Q1.1 through 2025.Q2.11. The vulnerability was reported by Lauritz Holme and publicly disclosed on September 8, 2025 (Liferay Advisory).

The vulnerability allows a remote authenticated attacker to inject JavaScript through the name of a fieldset in Kaleo Forms Admin. The malicious payload is stored and executed without proper sanitization or escaping. The vulnerability has been assigned a CVSS v4.0 base score of 4.8 (Medium) with the vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N (Liferay Advisory).

The vulnerability can lead to stored cross-site scripting attacks, potentially allowing attackers to execute malicious JavaScript code in users' browsers when they view the affected fieldset in Kaleo Forms Admin. This could result in theft of sensitive information, session hijacking, or other client-side attacks (NVD).

The vulnerability has been fixed in Liferay Portal master branch and the following DXP versions: 2025.Q2.12, 2025.Q1.17, and 2024.Q1.21. Users are advised to upgrade to these fixed versions to mitigate the vulnerability (Liferay Advisory).