{"action":"Upgrade com.liferay:com.liferay.product.navigation.control.menu.web to 6.0.83 or later.","affected":[{"fixed":"6.0.83","introduced":"6.0.80"}],"component":"com.liferay:com.liferay.product.navigation.control.menu.web","cve_ids":["CVE-2025-43815"],"ecosystem":"Maven","epss":0.00241,"exploited":false,"fixed_versions":["6.0.83"],"ghsa_id":"GHSA-wmjx-xv9v-r89q","id":"tcs_01M5N9GSCA5JVEX72BHM0EVDSR","modified_at":"2025-09-30T20:27:32.582157Z","published_at":"2025-09-30T00:30:28Z","references":["https://osv.dev/vulnerability/GHSA-wmjx-xv9v-r89q","https://nvd.nist.gov/vuln/detail/CVE-2025-43815","https://github.com/liferay/liferay-portal/commit/30d07ef9c95c66828818a4ba577ff56f8e2dd0d3","https://github.com/liferay/liferay-portal","https://liferay.atlassian.net/browse/LPE-17903","https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43815"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-wmjx-xv9v-r89q","url":"https://osv.dev/vulnerability/GHSA-wmjx-xv9v-r89q"},{"source":"nvd","source_id":"CVE-2025-43815","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43815"}],"summary":"Liferay Portal vulnerable to reflected cross-site scripting on the page configuration page"}