Vulnerability Database

313,519

Total vulnerabilities in the database

CVE-2025-4599

The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 update 61 through update 92 was found to be vulnerable to postMessage-based XSS because it allows a remote non-authenticated attacker to inject JavaScript into the fragment portlet URL.

  • Published: Aug 4, 2025
  • Updated: Dec 17, 2025
  • CVE: CVE-2025-4599
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 6.1
  • AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
liferay / digital_experience_platform 2024.q1.1 2024.q1.13.x
liferay / digital_experience_platform 2024.q2.0 2024.q2.13.x
liferay / digital_experience_platform 2024.q3.1 2024.q3.13.x
liferay / digital_experience_platform 2024.q4.1 2024.q4.5.x
liferay / digital_experience_platform 7.4 7.4.x
liferay / digital_experience_platform 7.4-update61 7.4-update61.x
liferay / digital_experience_platform 7.4-update62 7.4-update62.x
liferay / digital_experience_platform 7.4-update63 7.4-update63.x
liferay / digital_experience_platform 7.4-update64 7.4-update64.x
liferay / digital_experience_platform 7.4-update65 7.4-update65.x
liferay / digital_experience_platform 7.4-update66 7.4-update66.x
liferay / digital_experience_platform 7.4-update67 7.4-update67.x
liferay / digital_experience_platform 7.4-update68 7.4-update68.x
liferay / digital_experience_platform 7.4-update69 7.4-update69.x
liferay / digital_experience_platform 7.4-update70 7.4-update70.x
liferay / digital_experience_platform 7.4-update71 7.4-update71.x
liferay / digital_experience_platform 7.4-update72 7.4-update72.x
liferay / digital_experience_platform 7.4-update73 7.4-update73.x
liferay / digital_experience_platform 7.4-update74 7.4-update74.x
liferay / digital_experience_platform 7.4-update75 7.4-update75.x
liferay / digital_experience_platform 7.4-update76 7.4-update76.x
liferay / digital_experience_platform 7.4-update77 7.4-update77.x
liferay / digital_experience_platform 7.4-update78 7.4-update78.x
liferay / digital_experience_platform 7.4-update79 7.4-update79.x
liferay / digital_experience_platform 7.4-update80 7.4-update80.x
liferay / digital_experience_platform 7.4-update81 7.4-update81.x
liferay / digital_experience_platform 7.4-update82 7.4-update82.x
liferay / digital_experience_platform 7.4-update83 7.4-update83.x
liferay / digital_experience_platform 7.4-update84 7.4-update84.x
liferay / digital_experience_platform 7.4-update85 7.4-update85.x
liferay / digital_experience_platform 7.4-update86 7.4-update86.x
liferay / digital_experience_platform 7.4-update87 7.4-update87.x
liferay / digital_experience_platform 7.4-update88 7.4-update88.x
liferay / digital_experience_platform 7.4-update89 7.4-update89.x
liferay / digital_experience_platform 7.4-update90 7.4-update90.x
liferay / digital_experience_platform 7.4-update91 7.4-update91.x
liferay / digital_experience_platform 7.4-update92 7.4-update92.x
liferay / liferay_portal 7.4.3.61 7.4.3.132