There is a Cross-site scripting (XSS) vulnerability in Liferay Portal's Search widget . Versions 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 allow remote attackers to inject arbitrary web scripts or HTML via the `_com_liferay_portal_search_web_portlet_SearchPortlet_userId` parameter.

Affected Packages

Maven com.liferay:com.liferay.portal.search

Affected versions: 0 (fixed in 8.0.93)

Related CVEs

CVE-2025-43804

Key Information

GHSA ID

GHSA-ccrc-5vp5-vp5j

Published

September 17, 2025 12:31 AM

Last Modified

September 17, 2025 7:10 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

com.liferay:com.liferay.portal.search

GitHub Reviewed

✓ Yes

Dataset

Last updated: September 18, 2025 6:18 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.