CVE-2025-4388 – Liferay Portal/DXP Reflected Cross-Site Scripting (XSS) Vulnerability

May 6, 2025

CVE ID : CVE-2025-4388

Published : May 6, 2025, 6:15 p.m. | 1 hour, 19 minutes ago

Description : A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Source: Read More

Previous ArticleCVE-2025-46816 – “goshs Command Injection Vulnerability”

Next Article CVE-2025-46815 – ZITADEL IdP Intent Session Token Abuse

Sunshine And March Vibes (2025 Wallpapers Edition)

The Case For Minimal WordPress Setups: A Contrarian View On Theme Frameworks

How To Fix Largest Contentful Paint Issues With Subpart Analysis

How To Prevent WordPress SQL Injection Attacks

Diablo 4 gives you the chance to win a Mother’s Day candle and express your love (or hatred) with “Mother’s Judgement”

Here’s how to speedrun the Call of Duty: Black Ops 6 and Warzone Blaze of Glory event as fast as possible

How to prevent your PC from locking automatically on Windows 11

Frostpunk 2 heats up with a free “major content update” that overhauls the survival city builder’s core gameplay

Laravel Routing

Laravel Routing

Big Node, VS Code, and Mantine updates

Prepare for Contact Center Week with Colleen Eager

Diablo 4 gives you the chance to win a Mother’s Day candle and express your love (or hatred) with “Mother’s Judgement”

Diablo 4 gives you the chance to win a Mother’s Day candle and express your love (or hatred) with “Mother’s Judgement”

Here’s how to speedrun the Call of Duty: Black Ops 6 and Warzone Blaze of Glory event as fast as possible

How to prevent your PC from locking automatically on Windows 11

CVE-2025-4388 – Liferay Portal/DXP Reflected Cross-Site Scripting (XSS) Vulnerability

SonicWall Confirms Active Exploitation of Flaws Affecting Multiple Appliance Models

Commvault Confirms Hackers Exploited CVE-2025-3928 as Zero-Day in Azure Breach

Index types supported in Amazon Aurora PostgreSQL and Amazon RDS for PostgreSQL (GIN, GiST, HASH, BRIN)

No cash, just exposure: Appleâ€™s unique deal to bring ChatGPT to its platforms

From Speech To Musical Instrument (Creating Music In The Browser)

Racing into 2025 with new GitHub Innovation Graph data

This AI Study Saves Researchers from Metadata Chaos with a Comparative Analysis of Extraction Techniques for Scholarly Documents

Google Patches Yet Another Actively Exploited Chrome Zero-Day Vulnerability

Free IRS Direct File service for taxpayers to end, according to reports

Exploring the Diverse Roles in UX Design

CVE-2025-4388 – Liferay Portal/DXP Reflected Cross-Site Scripting (XSS) Vulnerability

Related Posts