CVE-2016-3670

6.1 mediumEPSS 2.5%

Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.

Severity

CVSS 3.0

6.1 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2016-06-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

liferay:liferay_portal

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-hq29-vqg6-pjpw	Maven	com.liferay:com.liferay.portal.search.web	<1.0.3	1.0.3

References

http://packetstormsecurity.com/files/137279/Liferay-CE-Stored-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2016/Jun/5
http://www.securitytracker.com/id/1036083
https://issues.liferay.com/browse/LPS-62387
https://labs.integrity.pt/advisories/cve-2016-3670/

Check your stack JSON