CVE-2016-3670 EXPLOIT
6.1
MEDIUM · CVSS 3.0 · EPSS 2.5% (pctl 84)
Patch early
A public exploit exists.
Description
Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.
Scoring
| CVSS | 6.1 (MEDIUM, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| EPSS | 2.49% — more likely to be exploited than 84% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2016-06-13 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| liferay | liferay portal |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Liferay CE < 6.2 CE GA6 - Persistent Cross-Site Scripting | 2016-06-02 |
References
- http://packetstormsecurity.com/files/137279/Liferay-CE-Stored-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2016/Jun/5
- http://www.securitytracker.com/id/1036083
- https://issues.liferay.com/browse/LPS-62387
- https://labs.integrity.pt/advisories/cve-2016-3670/
- https://www.exploit-db.com/exploits/39880/
- http://packetstormsecurity.com/files/137279/Liferay-CE-Stored-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2016/Jun/5
- http://www.securitytracker.com/id/1036083
- https://issues.liferay.com/browse/LPS-62387
- https://labs.integrity.pt/advisories/cve-2016-3670/
- https://www.exploit-db.com/exploits/39880/
→ the Explorer · watch your stack · NVD