CVE-2025-62264: XSS
Published Oct 31, 2025
·Updated
Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92 allows remote attackers to inject arbitrary web script or HTML via the comliferayportallanguageoverridewebinternalportletPLOPortletselectedLanguageId parameter.
Affected Software
115 affected componentsFixes available
Liferay portal>=7.4.3.8<=7.4.3.111
Liferay DXP>=2023.Q4.0<=2023.Q4.10, >=2023.Q3.1<=2023.Q3.10
Liferay portal>=7.4 update 4<=7.4 update 92
maven/com.liferay.portal:release.portal.bom>=7.4.3.8<7.4.3.112-ga112
7.4.3.112-ga112
Liferay Digital Experience Platform=7.4-update10
Liferay Digital Experience Platform=7.4-update11
Liferay Digital Experience Platform=7.4-update12
Liferay Digital Experience Platform=7.4-update13
Liferay Digital Experience Platform=7.4-update14
Liferay Digital Experience Platform=7.4-update15
Liferay Digital Experience Platform=7.4-update16
Liferay Digital Experience Platform=7.4-update17
Liferay Digital Experience Platform=7.4-update18
Liferay Digital Experience Platform=7.4-update19
Liferay Digital Experience Platform=7.4-update20
Liferay Digital Experience Platform=7.4-update21
Liferay Digital Experience Platform=7.4-update22
Liferay Digital Experience Platform=7.4-update23
Liferay Digital Experience Platform=7.4-update24
Liferay Digital Experience Platform=7.4-update25
Liferay Digital Experience Platform=7.4-update26
Liferay Digital Experience Platform=7.4-update27
Liferay Digital Experience Platform=7.4-update28
Liferay Digital Experience Platform=7.4-update29
Liferay Digital Experience Platform=7.4-update30
Liferay Digital Experience Platform=7.4-update31
Liferay Digital Experience Platform=7.4-update32
Liferay Digital Experience Platform=7.4-update33
Liferay Digital Experience Platform=7.4-update34
Liferay Digital Experience Platform=7.4-update35
Liferay Digital Experience Platform=7.4-update36
Liferay Digital Experience Platform=7.4-update37
Liferay Digital Experience Platform=7.4-update38
Liferay Digital Experience Platform=7.4-update39
Liferay Digital Experience Platform=7.4-update4
Liferay Digital Experience Platform=7.4-update40
Liferay Digital Experience Platform=7.4-update41
Liferay Digital Experience Platform=7.4-update42
Liferay Digital Experience Platform=7.4-update43
Liferay Digital Experience Platform=7.4-update44
Liferay Digital Experience Platform=7.4-update45
Liferay Digital Experience Platform=7.4-update46
Liferay Digital Experience Platform=7.4-update47
Liferay Digital Experience Platform=7.4-update48
Liferay Digital Experience Platform=7.4-update49
Liferay Digital Experience Platform=7.4-update5
Liferay Digital Experience Platform=7.4-update50
Liferay Digital Experience Platform=7.4-update51
Liferay Digital Experience Platform=7.4-update52
Liferay Digital Experience Platform=7.4-update53
Liferay Digital Experience Platform=7.4-update54
Liferay Digital Experience Platform=7.4-update55
Liferay Digital Experience Platform=7.4-update56
Liferay Digital Experience Platform=7.4-update57
Liferay Digital Experience Platform=7.4-update58
Liferay Digital Experience Platform=7.4-update59
Liferay Digital Experience Platform=7.4-update6
Liferay Digital Experience Platform=7.4-update60
Liferay Digital Experience Platform=7.4-update61
Liferay Digital Experience Platform=7.4-update62
Liferay Digital Experience Platform=7.4-update63
Liferay Digital Experience Platform=7.4-update64
Liferay Digital Experience Platform=7.4-update65
Liferay Digital Experience Platform=7.4-update66
Liferay Digital Experience Platform=7.4-update67
Liferay Digital Experience Platform=7.4-update68
Liferay Digital Experience Platform=7.4-update69
Liferay Digital Experience Platform=7.4-update7
Liferay Digital Experience Platform=7.4-update70
Liferay Digital Experience Platform=7.4-update71
Liferay Digital Experience Platform=7.4-update72
Liferay Digital Experience Platform=7.4-update73
Liferay Digital Experience Platform=7.4-update74
Liferay Digital Experience Platform=7.4-update75
Liferay Digital Experience Platform=7.4-update76
Liferay Digital Experience Platform=7.4-update77
Liferay Digital Experience Platform=7.4-update78
Liferay Digital Experience Platform=7.4-update79
Liferay Digital Experience Platform=7.4-update8
Liferay Digital Experience Platform=7.4-update80
Liferay Digital Experience Platform=7.4-update81
Liferay Digital Experience Platform=7.4-update82
Liferay Digital Experience Platform=7.4-update83
Liferay Digital Experience Platform=7.4-update84
Liferay Digital Experience Platform=7.4-update85
Liferay Digital Experience Platform=7.4-update86
Liferay Digital Experience Platform=7.4-update87
Liferay Digital Experience Platform=7.4-update88
Liferay Digital Experience Platform=7.4-update89
Liferay Digital Experience Platform=7.4-update9
Liferay Digital Experience Platform=7.4-update90
Liferay Digital Experience Platform=7.4-update91
Liferay Digital Experience Platform=7.4-update92
Liferay Digital Experience Platform=2023.q3.1
Liferay Digital Experience Platform=2023.q3.2
Liferay Digital Experience Platform=2023.q3.3
Liferay Digital Experience Platform=2023.q3.4
Liferay Digital Experience Platform=2023.q3.5
Liferay Digital Experience Platform=2023.q3.6
Liferay Digital Experience Platform=2023.q3.7
Liferay Digital Experience Platform=2023.q3.8
Liferay Digital Experience Platform=2023.q3.9
Liferay Digital Experience Platform=2023.q3.10
Liferay Digital Experience Platform=2023.q4.0
Liferay Digital Experience Platform=2023.q4.1
Liferay Digital Experience Platform=2023.q4.2
Liferay Digital Experience Platform=2023.q4.3
Liferay Digital Experience Platform=2023.q4.4
Liferay Digital Experience Platform=2023.q4.5
Liferay Digital Experience Platform=2023.q4.6
Liferay Digital Experience Platform=2023.q4.7
Liferay Digital Experience Platform=2023.q4.8
Liferay Digital Experience Platform=2023.q4.9
Liferay Digital Experience Platform=2023.q4.10
Liferay Liferay Portal>=7.4.3.8<7.4.3.112
Event History
Oct 31, 2025
CVE Published
via MITRE·05:32 PM
Data Sourced
via MITRE·05:32 PM
DescriptionWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·06:31 PM
Data Sourced
via GitHub·06:31 PM
DescriptionWeaknessAffected Software
Data Sourced
via GitHub·06:31 PM
Severity
Frequently Asked Questions
1
What is the severity of CVE-2025-62264?
CVE-2025-62264 has been classified as a high-severity reflected cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2025-62264?
To fix CVE-2025-62264, ensure that your Liferay Portal or Liferay DXP software is updated to the latest version that has patched this vulnerability.
3
What versions are affected by CVE-2025-62264?
CVE-2025-62264 affects Liferay Portal versions 7.4.3.8 through 7.4.3.111 and Liferay DXP versions 2023.Q4.0 through 2023.Q4.10 and 2023.Q3.1 through 2023.Q3.10.
4
Who can exploit CVE-2025-62264?
Remote attackers can exploit CVE-2025-62264 to inject arbitrary web scripts or HTML into vulnerable Liferay Portal or DXP instances.
5
What is reflected cross-site scripting in CVE-2025-62264?
Reflected cross-site scripting in CVE-2025-62264 allows attackers to inject scripts that are executed immediately in the user's browser, potentially compromising sensitive information.