UpHeron
All vulnerabilities

Servers and applications

CVE-2025-62237

Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 8 through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account’s “Name” text field.

Severity
Medium 4.8
Published
10 Oct 2025
Last changed
18 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.4.3.112, 2023.q3.9, 2023.q4.6
Sources
NVD

Affected software

SoftwareAffected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
  • From 2023.q4.0 before 2023.q4.6
  • From 2023.q3.1 before 2023.q3.9
  • Version 7.4-update92
  • Version 7.4-update91
All 88 release lines
  • Version 7.4
  • Version 7.4-update8
  • Version 7.4-update9
  • Version 7.4-update10
  • Version 7.4-update11
  • Version 7.4-update12
  • Version 7.4-update13
  • Version 7.4-update14
  • Version 7.4-update15
  • Version 7.4-update16
  • Version 7.4-update17
  • Version 7.4-update18
  • Version 7.4-update19
  • Version 7.4-update20
  • Version 7.4-update21
  • Version 7.4-update22
  • Version 7.4-update23
  • Version 7.4-update24
  • Version 7.4-update25
  • Version 7.4-update26
  • Version 7.4-update27
  • Version 7.4-update28
  • Version 7.4-update29
  • Version 7.4-update30
  • Version 7.4-update31
  • Version 7.4-update32
  • Version 7.4-update33
  • Version 7.4-update34
  • Version 7.4-update35
  • Version 7.4-update36
  • Version 7.4-update37
  • Version 7.4-update38
  • Version 7.4-update39
  • Version 7.4-update40
  • Version 7.4-update41
  • Version 7.4-update42
  • Version 7.4-update43
  • Version 7.4-update44
  • Version 7.4-update45
  • Version 7.4-update46
  • Version 7.4-update47
  • Version 7.4-update48
  • Version 7.4-update49
  • Version 7.4-update50
  • Version 7.4-update51
  • Version 7.4-update52
  • Version 7.4-update53
  • Version 7.4-update54
  • Version 7.4-update55
  • Version 7.4-update56
  • Version 7.4-update57
  • Version 7.4-update58
  • Version 7.4-update59
  • Version 7.4-update60
  • Version 7.4-update61
  • Version 7.4-update62
  • Version 7.4-update63
  • Version 7.4-update64
  • Version 7.4-update65
  • Version 7.4-update66
  • Version 7.4-update67
  • Version 7.4-update68
  • Version 7.4-update69
  • Version 7.4-update70
  • Version 7.4-update71
  • Version 7.4-update72
  • Version 7.4-update73
  • Version 7.4-update74
  • Version 7.4-update75
  • Version 7.4-update76
  • Version 7.4-update77
  • Version 7.4-update78
  • Version 7.4-update79
  • Version 7.4-update80
  • Version 7.4-update81
  • Version 7.4-update82
  • Version 7.4-update83
  • Version 7.4-update84
  • Version 7.4-update85
  • Version 7.4-update86
  • Version 7.4-update87
  • Version 7.4-update88
  • Version 7.4-update89
  • Version 7.4-update90
  • Version 7.4-update91
  • Version 7.4-update92
  • From 2023.q3.1 before 2023.q3.9
  • From 2023.q4.0 before 2023.q4.6
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal
  • From 7.4.3.8 before 7.4.3.112

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-62237
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-62237