Description
A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.
Remediation
References
Related Vulnerabilities
WordPress Plugin Booked-Appointment Booking for WordPress Security Bypass (2.2.5)
Oracle JRE CVE-2022-21365 Vulnerability (CVE-2022-21365)
WordPress Plugin Event Calendar WD-Responsive Event Calendar Cross-Site Scripting (1.1.42)
PHP Resource Management Errors Vulnerability (CVE-2012-0789)
WordPress Plugin AnyMind Widget Cross-Site Request Forgery (1.1)