CVE-2016-3670

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-06-13 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.

Affected products

Liferay Portal: through 6.2

References

http://packetstormsecurity.com/files/137279/Liferay-CE-Stored-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2016/Jun/5
http://www.securitytracker.com/id/1036083
https://issues.liferay.com/browse/LPS-62387
https://labs.integrity.pt/advisories/cve-2016-3670/
https://www.exploit-db.com/exploits/39880/
http://packetstormsecurity.com/files/137279/Liferay-CE-Stored-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2016/Jun/5
http://www.securitytracker.com/id/1036083
https://issues.liferay.com/browse/LPS-62387
https://labs.integrity.pt/advisories/cve-2016-3670/
https://www.exploit-db.com/exploits/39880/

Get alerted when CVE-2016-3670 or the next vulnerability affects your stack