Medium
Security advisory
Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 82 through update 92 in the Frontend JS module's layout-taglib/__liferay__/index.js allows remote attackers to inject arbitrary web script or HTML via toastData parameter
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-2536
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:38 UTC · Revision 1
Source evidence
Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 82 through update 92 in the Frontend JS module's layout-taglib/__liferay__/index.js allows remote attackers to inject arbitrary web script or HTML via toastData parameter
osv:CVE-2025-2536
Complete source record
{
"id": "992523214c87066a12c2aa658383b214fc9b08c4324d7f4e26a27ce9699e6acd",
"url": "https://osv.dev/vulnerability/CVE-2025-2536",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2025-2536",
"summary": "Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 82 through update 92 in the Frontend JS module's layout-taglib/__liferay__/index.js allows remote attackers to inject arbitrary web script or HTML via toastData parameter",
"evidence": "osv:CVE-2025-2536",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2025-2536",
"aliases": [
"CVE-2025-2536",
"GHSA-hrc4-p2h3-pjqw"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/liferay/liferay-portal",
"type": "GIT",
"events": [
{
"introduced": "81272f274ff018cb2d4df494840c76fdc81501d9"
},
{
"last_affected": "e952f16c63d584e727b16cf07ece5e4dbedba801"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.4.3.82"
},
{
"last_affected": "7.4.3.128"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-2536.json"
}
}
],
"modified": "2026-10-24T10:30:31.533031936Z",
"provider": "osv",
"references": [
"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-2536"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*"
],
"vendor_product": "liferay:digital_experience_platform",
"extracted_events": [
{
"range": [
{
"introduced": "2023.Q3.1"
},
{
"last_affected": "2023.Q3.10"
},
{
"introduced": "2023.q4.0"
},
{
"last_affected": "2023.q4.10"
},
{
"introduced": "2024.q1.1"
},
{
"last_affected": "2024.q1.12"
},
{
"introduced": "2024.q2.0"
},
{
"last_affected": "2024.q2.13"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:liferay:digital_experience_platform:2024.q3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*"
],
"vendor_product": "liferay:digital_experience_platform",
"extracted_events": [
{
"range": [
{
"introduced": "7.4-update82"
},
{
"last_affected": "7.4-update82"
},
{
"introduced": "7.4-update83"
},
{
"last_affected": "7.4-update83"
},
{
"introduced": "7.4-update84"
},
{
"last_affected": "7.4-update84"
},
{
"introduced": "7.4-update85"
},
{
"last_affected": "7.4-update85"
},
{
"introduced": "7.4-update86"
},
{
"last_affected": "7.4-update86"
},
{
"introduced": "7.4-update87"
},
{
"last_affected": "7.4-update87"
},
{
"introduced": "7.4-update88"
},
{
"last_affected": "7.4-update88"
},
{
"introduced": "7.4-update89"
},
{
"last_affected": "7.4-update89"
},
{
"introduced": "7.4-update90"
},
{
"last_affected": "7.4-update90"
},
{
"introduced": "7.4-update91"
},
{
"last_affected": "7.4-update91"
},
{
"introduced": "7.4-update92"
},
{
"last_affected": "7.4-update92"
},
{
"introduced": "2024.q3.0"
},
{
"last_affected": "2024.q3.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2025-2536",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 432831,
"published_at": "2025-03-19T19:15:50.56+00:00"
}