CVE-2025-43781: 
Java vulnerability analysis and mitigation

A reflected cross-site scripting (XSS) vulnerability was discovered in Liferay Portal and Liferay DXP, identified as CVE-2025-43781. The vulnerability affects Liferay Portal versions 7.4.3.110 through 7.4.3.128, and multiple versions of Liferay DXP including 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.12. The vulnerability was disclosed on September 9, 2025 (NVD, Liferay Advisory).

The vulnerability allows remote attackers to inject arbitrary web script or HTML through the URL in the search bar portlet. The vulnerability has been assigned a CVSS v4.0 base score of 5.3 (Medium) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N. This indicates that the vulnerability can be exploited remotely, requires low attack complexity, no privileges, but does require passive user interaction (Liferay Advisory).

The vulnerability can lead to the execution of arbitrary web scripts or HTML in the context of the user's browser session. This could potentially allow attackers to steal session tokens, access sensitive information, or perform actions on behalf of the user (NVD).

The vulnerability has been fixed in Liferay Portal version 7.4.3.129 and Liferay DXP versions 2024.Q1.13, 2024.Q3.9, and 2024.Q4.0. Users are advised to upgrade to these or later versions to mitigate the vulnerability (Liferay Advisory).