CVE-2025-43778: 
Java vulnerability analysis and mitigation

A Stored cross-site scripting vulnerability (CVE-2025-43778) was discovered in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP versions from 2024.Q1.1 through 2025.Q2.11. The vulnerability was disclosed on September 8, 2025, and affects the Kaleo Forms Admin component (Liferay Dev).

The vulnerability allows remote authenticated attackers to inject JavaScript through the name of a fieldset in Kaleo Forms Admin. The malicious payload is stored and executed without proper sanitization or escaping of user input. The vulnerability has been assigned a CVSS 4.0 score of 4.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N), indicating a medium severity level (Liferay Dev).

The vulnerability can lead to stored cross-site scripting attacks, potentially allowing attackers to execute arbitrary JavaScript code in the context of other users' browsers who access the affected fieldset. This could result in theft of sensitive information, session hijacking, or other malicious actions (Liferay Dev).

The vulnerability has been fixed in Liferay Portal's master branch and Liferay DXP versions 2025.Q1.17 and 2025.Q2.12. Organizations using affected versions should upgrade to the fixed versions to mitigate the vulnerability (Liferay Dev).