CVE-2025-43769: Liferay Portal vulnerable to Stored XSS in Components portlet

The analysis of the provided commit 0249230a00a8ab42a5edaf6bca1bcf594525c0e9 clearly indicates a stored cross-site scripting (XSS) vulnerability in the portlets.jspf file. The patch applies HTML escaping to the title variable, which was previously rendered directly to the page. This lack of output sanitization is the root cause of the vulnerability. An attacker could create a portlet with a malicious title containing a script. When an administrator views the list of portlets in the 'Components' tab, the malicious script would execute in their browser, leading to potential account takeover or other malicious actions. The vulnerable code is located in a JSP fragment file, which is included in a larger JSP page for rendering the UI. Therefore, the JSP file itself is identified as the vulnerable component.