{"action":"Upgrade com.liferay:com.liferay.change.tracking.service to 3.0.91 or later.","affected":[{"fixed":"3.0.91","introduced":"0"}],"component":"com.liferay:com.liferay.change.tracking.service","cve_ids":["CVE-2025-43807"],"ecosystem":"Maven","epss":0.00218,"exploited":false,"fixed_versions":["3.0.91"],"ghsa_id":"GHSA-jh9h-8xf2-25wj","id":"tcs_01M5N9305EH82H97GC795TY0BV","modified_at":"2025-12-17T00:10:01.257860Z","published_at":"2025-09-22T18:30:37Z","references":["https://osv.dev/vulnerability/GHSA-jh9h-8xf2-25wj","https://nvd.nist.gov/vuln/detail/CVE-2025-43807","https://github.com/liferay/liferay-portal/commit/aaf32ff25affc0d63adc79abaedc9f565f033789","https://github.com/liferay/liferay-portal","https://liferay.atlassian.net/browse/LPE-17923","https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43807"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-jh9h-8xf2-25wj","url":"https://osv.dev/vulnerability/GHSA-jh9h-8xf2-25wj"},{"source":"nvd","source_id":"CVE-2025-43807","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43807"}],"summary":"Liferay has a stored cross-site scripting (XSS) vulnerability via a a publication’s “Name” text field"}