Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId` parameter.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62264 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.1 · liferayNVD modified 2026-10-18 21:10
Affected (CPE criteria) 111
cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update16:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update17:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update18:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update19:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update20:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update22:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update23:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update24:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update25:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update26:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update39:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update4:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update40:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update42:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update43:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update44:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update45:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update46:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update47:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*- and 71 more