CVE-2025-43793
Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions may incorrectly identify the subdomain of a domain name and create a supercookie, which allows remote attackers who control a website that share the same TLD to read cookies set by the application.
We have discovered 51 live websites that are affected by CVE-2025-43793.
Affected Software
| Product |  Liferay |
| Category | Content Management System |
| Vulnerable Domains | 51 live websites (2.00% of Liferay install base) |
| Vulnerable Versions |
|
| Vulnerable Versions Count | 13 versions ( 22% of all versions) |
Common Weakness Enumeration
CWE-1284 Improper Validation of Specified Quantity in InputDetails
- Published - Sep 15, 2025
- Updated - Sep 15, 2025
CVE References
CWE References
CWE
Website Distribution by Country
Number of websites using CVE-2025-43793 United States | 15 websites |
 Spain | 8 websites |
 Italy | 7 websites |
 Germany | 6 websites |
 GB | 4 websites |
 Brazil | 3 websites |
 Portugal | 3 websites |
 Belgium | 1 websites |
 Bahrain | 1 websites |
 Switzerland | 1 websites |
Website Distribution by TLD
Number of websites using CVE-2025-43793| .com | 16 websites |
| .es | 6 websites |
| .co.uk | 4 websites |
| .de | 4 websites |
| .it | 4 websites |
| .org | 4 websites |
| .be | 1 websites |
| .cz | 1 websites |
| .pl | 1 websites |
Vulnerable Versions
Vulnerable versions are highlighted in redWebsites affected by CVE-2025-43793
Top websites that are affected by CVE-2025-43793. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ****.***.it | Italy | **,*** | |
| ******.****.***.it | Italy | ***,*** | |
| *****.****.***.it | Italy | ***,*** | |
| **************.de | Germany | ***,*** | |
| ***********.*****.pl |  Poland | ***,*** | |
| **.**.***.br | Brazil | ***,*** | |
| *****.pt | Portugal | *,***,*** | |
| ************.****.org | Germany | *,***,*** | |
| *****.****.***.br | Brazil | *,***,*** | |
| **************.***.bh | Bahrain | *,***,*** |
FAQ
CVE-2025-43793 is Improper Validation of Specified Quantity in Input in Liferay
A total of 51 websites have been identified as vulnerable to CVE-2025-43793, based on global website indexing conducted by WebTechSurvey.
The Liferay is affected by the CVE-2025-43793 vulnerability.
Liferay versions up to and including 7.4.3.105 are vulnerable to CVE-2025-43793.