CVE-2025-62255
NoneLiferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page
CVSS
—
EPSS
0.2%
Published
Oct 23, 2025
CISA due date
—
The record
Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an attachment's filename.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.liferay:com.liferay.knowledge.base.web | 0 | 5.0.109 |
Related vulnerabilities
- GHSA-gccf-r9xp-x8jx Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base… Same vulnerability
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96360 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96357 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79