NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
☕ Maven
Not in CISA KEV

Liferay Portal Reflected Cross-Site Scripting Vulnerability via snippet ParameterGHSA-q2gv-w583-f2vq

Fix: liferay/liferay-portal@6228bb1

GHSA-q2gv-w583-f2vq is a Cross-site Scripting (XSS) vulnerability in com.liferay.portal:release.portal.bom. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.

Also known asCVE-2025-43756
Published
Updated
Affected
1 pkg
Patched
See advisory
Exploits
None indexed
Exploitation data as of Nov 11, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-q2gv-w583-f2vq.

EPSS Exploitation Probability

via FIRST.org ↗
0.2%probability of exploitation in next 30 days
Lower Risk+0.02%
Lower risk than most CVEs15th percentile — riskier than 15% of all scored CVEsHighest risk
0.00%0.25%0.49%0.74%0.0%0.2%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

1 pkg affected
☕com.liferay.portal:release.portal.bom

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

<!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}-->A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.15, 2025.Q2.0 through 2025.Q2.2 and 2024.Q1.13 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via snippet parameter.

Affected Packages

1 total
EcosystemPackageVulnerable rangeFix
☕Mavencom.liferay.portal:release.portal.bomall versionsNo fix

Affected Products

2 products · 4 configurations
Application
digital experience platformliferay
≥ 2025.Q2.0 && < 2025.Q2.3
range
Application
liferay portalliferay
1 version
7.4.3.132

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for com.liferay.portal:release.portal.bom, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Remediation status

    The records we use list no patched version of com.liferay.portal:release.portal.bom for GHSA-q2gv-w583-f2vq. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.

  3. Mitigate without a patch

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.15, 2025.Q2.0 through 2025.Q2.2 and 2024.Q1.13 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via snippet parameter.
O3 Security · Impact-Aware SCA

Is GHSA-q2gv-w583-f2vq in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
Liferay Portal Reflected Cross-Site Scripting Vulnerability…