{"action":"Upgrade com.liferay:com.liferay.journal.web to 5.0.196 or later.","affected":[{"fixed":"5.0.196","introduced":"0"}],"component":"com.liferay:com.liferay.journal.web","cve_ids":["CVE-2025-43737"],"ecosystem":"Maven","epss":0.00285,"exploited":false,"fixed_versions":["5.0.196"],"ghsa_id":"GHSA-vjwr-cqwf-6q96","id":"tcs_01M5N9E9MZ4R7W1RYJAZQY13SS","modified_at":"2025-08-20T20:12:20.359187Z","published_at":"2025-08-19T21:30:36Z","references":["https://osv.dev/vulnerability/GHSA-vjwr-cqwf-6q96","https://nvd.nist.gov/vuln/detail/CVE-2025-43737","https://github.com/liferay/liferay-portal/commit/eded63b8822923f9392d94ba1818beb63629b79f","https://github.com/liferay/liferay-portal","https://liferay.atlassian.net/browse/LPE-18292","https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43737"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-vjwr-cqwf-6q96","url":"https://osv.dev/vulnerability/GHSA-vjwr-cqwf-6q96"},{"source":"nvd","source_id":"CVE-2025-43737","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43737"}],"summary":"Liferay Portal Vulnerable to Cross-Site Scripting via backURL Paramter"}