CVE-2025-62267: 
Java vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability was discovered in Liferay Portal and Liferay DXP's web content template's select structure page. The vulnerability (CVE-2025-62267) affects multiple versions of the software, including Liferay Portal 7.4.3.35 through 7.4.3.111, Liferay DXP 2023.Q4.0 through 2023.Q4.10, and Liferay DXP 2023.Q3.1 through 2023.Q3.10. The issue was disclosed on October 31, 2025 (Liferay Security).

The vulnerability allows remote attackers to inject arbitrary web script or HTML through three different user input fields: First Name, Middle Name, and Last Name text fields in the web content template's select structure page. The vulnerability has been assigned a CVSS v4.0 score of 4.6 (AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N) (Liferay Security).

The vulnerability can lead to the execution of arbitrary web scripts or HTML in the context of other users' browsers who access the affected pages. This could potentially lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected user's session (Liferay Security).

The vulnerability has been fixed in Liferay Portal version 7.4.3.112 and Liferay DXP version 2024.Q1.1. Users are advised to upgrade to these or later versions to mitigate the vulnerability (Liferay Security).