CVE-2025-43810Active Exploitation(liferay / digital_experience_platform)

LOWCVSS 4.3 · MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for liferay digital_experience_platform systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to add a note to an order in a different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.

liferay CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43810

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

digital_experience_platform
liferay_portal

Threat summary

Active exploitation appears in 1 classified signals
1 mentions across 1 observed day

What's happening

Active exploitation reported across 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Affected systems

Vendors

liferay

Products

digital_experience_platformliferay_portal

1 version affected across 2 products

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Active Exploitation

1100.0%

Full discourse1 post

bigmacd@bigmacd16684200d
Active Exploitation
GPU sandbox escape (CVE-2025-43810) & local privilege escalation (CVE-2025-43520) exploit iOS 18.4-18.7 via a malicious Safari page for full kernel control. Various threat actors leveraged this vulnerability. #iOSsecurity
Post summary
The post indicates that CVE‑2025‑43810 and CVE‑2025‑43520 provide full kernel control on iOS 18.x when exploited via malicious Safari pages, with multiple threat actors already leveraging them, yet no PoC or patch details are provided.
10000112
4 followersView on X

CPE platform detail75 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

75 of 75 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	liferay	digital_experience_platform	-	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	digital_experience_platform	7.4	-	-
App	liferay	liferay_portal	-	-	-

Explore more

Back to dashboard liferay CVEs digital_experience_platform vulnerabilities