GHSA-q8fj-76q7-4p7h

Suggest an improvement
Source
https://github.com/advisories/GHSA-q8fj-76q7-4p7h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q8fj-76q7-4p7h/GHSA-q8fj-76q7-4p7h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-q8fj-76q7-4p7h
Aliases
Published
2025-10-08T15:32:27Z
Modified
2025-10-09T15:59:13Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Liferay Portal Notifications Widget has multiple XSS vulnerabilities through various text fields
Details

Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.10 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into (1) a user’s “First Name” text field, (2) a user’s “Middle Name” text field, (3) a user’s “Last Name” text field, (4) the “Other Reason” text field when flagging content, or (5) the name of the flagged content.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-10-09T15:29:02Z",
    "nvd_published_at":  "2025-10-08T15:16:23Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / com.liferay:com.liferay.flags.web

Package

Name
com.liferay:com.liferay.flags.web
View open source insights on deps.dev
Purl
pkg:maven/com.liferay/com.liferay.flags.web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.23
Fixed
6.0.24

Affected versions

6.*
6.0.23

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q8fj-76q7-4p7h/GHSA-q8fj-76q7-4p7h.json"