Description

Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.

Remediation

References

CVE-2023-42629

Related Vulnerabilities

WordPress Plugin oQey Gallery 'tbpv_domain' Parameter Cross-Site Scripting (0.2)

WordPress Plugin YITH WooCommerce Affiliates Security Bypass (1.6.3)

WordPress Plugin Email Subscribers by Icegram Express-Email Marketing, Newsletters, Automation for WordPress & WooCommerce Security Bypass (3.5.13)

Zenphoto Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2009-4566)

WordPress Plugin HUSKY-Products Filter Professional for WooCommerce SQL Injection (1.3.6)

Severity

Medium

Classification

CVE-2023-42629 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities