https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-62267.htmlhttps://patchthecve.com/cve/CVE-2025-62267.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.1: Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 35 through update 92 allow remote attackers to inject arbitrary webhttps://patchthecve.com/cve/CVE-2025-62264.htmlhttps://patchthecve.com/cve/CVE-2025-62264.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.1: Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92 allows remote attackers to inject arbitrary web script or HTML via the https://patchthecve.com/cve/CVE-2025-62265.htmlhttps://patchthecve.com/cve/CVE-2025-62265.htmlSun, 18 Oct 2026 00:10:00 +0000MEDIUM 5.4: Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allowshttps://patchthecve.com/cve/CVE-2025-62266.htmlhttps://patchthecve.com/cve/CVE-2025-62266.htmlSun, 18 Oct 2026 00:10:00 +0000MEDIUM 6.1: By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows rhttps://patchthecve.com/cve/CVE-2025-62257.htmlhttps://patchthecve.com/cve/CVE-2025-62257.htmlSun, 18 Oct 2026 00:10:00 +0000MEDIUM 5.3: Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to dhttps://patchthecve.com/cve/CVE-2025-62259.htmlhttps://patchthecve.com/cve/CVE-2025-62259.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.4: Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified their email address, which allows remote ushttps://patchthecve.com/cve/CVE-2025-62258.htmlhttps://patchthecve.com/cve/CVE-2025-62258.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.5: CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter.https://patchthecve.com/cve/CVE-2025-62261.htmlhttps://patchthecve.com/cve/CVE-2025-62261.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.5: Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obthttps://patchthecve.com/cve/CVE-2025-62260.htmlhttps://patchthecve.com/cve/CVE-2025-62260.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.5: Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service https://patchthecve.com/cve/CVE-2025-62262.htmlhttps://patchthecve.com/cve/CVE-2025-62262.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 4.4: Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows local users to vhttps://patchthecve.com/cve/CVE-2025-62263.htmlhttps://patchthecve.com/cve/CVE-2025-62263.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.4: Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 service pack 3 through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected intohttps://patchthecve.com/cve/CVE-2025-62253.htmlhttps://patchthecve.com/cve/CVE-2025-62253.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.1: Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect https://patchthecve.com/cve/CVE-2025-62254.htmlhttps://patchthecve.com/cve/CVE-2025-62254.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.5: The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number or size of the files it https://patchthecve.com/cve/CVE-2025-62255.htmlhttps://patchthecve.com/cve/CVE-2025-62255.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.1: Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions allows remote attackers to inject arhttps://patchthecve.com/cve/CVE-2025-62256.htmlhttps://patchthecve.com/cve/CVE-2025-62256.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.3: Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not properly restrict access to OpenAPI in certain circumstances, which allows remote attackers thttps://patchthecve.com/cve/CVE-2025-62249.htmlhttps://patchthecve.com/cve/CVE-2025-62249.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.1: A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Qhttps://patchthecve.com/cve/CVE-2025-62250.htmlhttps://patchthecve.com/cve/CVE-2025-62250.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.5: Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to send malicious data to the Liferay https://patchthecve.com/cve/CVE-2025-62251.htmlhttps://patchthecve.com/cve/CVE-2025-62251.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.5: Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows content to users who do not have permission to view it via the Menu Display Widget. This security flaw could result in sensitivhttps://patchthecve.com/cve/CVE-2025-62252.htmlhttps://patchthecve.com/cve/CVE-2025-62252.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 4.3: Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote authenticated users in onhttps://patchthecve.com/cve/CVE-2025-62246.htmlhttps://patchthecve.com/cve/CVE-2025-62246.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.4: Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions allow remote authenticated users tohttps://patchthecve.com/cve/CVE-2025-62242.htmlhttps://patchthecve.com/cve/CVE-2025-62242.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 4.3: Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses frohttps://patchthecve.com/cve/CVE-2025-62241.htmlhttps://patchthecve.com/cve/CVE-2025-62241.htmlThu, 08 Oct 2026 12:10:00 +0000MEDIUM 4.3: Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to from one virtual instance to view the shipment addresses of different virtual instance via the _com_liferay_commerce_order_web_internal_portlehttps://patchthecve.com/cve/CVE-2025-62243.htmlhttps://patchthecve.com/cve/CVE-2025-62243.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.4: Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the _com_lifehttps://patchthecve.com/cve/CVE-2025-62244.htmlhttps://patchthecve.com/cve/CVE-2025-62244.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 4.3: Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and 7.3 GA through update 36 allows remote authenticated attackers to view the edithttps://patchthecve.com/cve/CVE-2025-62245.htmlhttps://patchthecve.com/cve/CVE-2025-62245.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 4.3: Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.https://patchthecve.com/cve/CVE-2025-62239.htmlhttps://patchthecve.com/cve/CVE-2025-62239.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.4: Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTMhttps://patchthecve.com/cve/CVE-2025-62238.htmlhttps://patchthecve.com/cve/CVE-2025-62238.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.4: Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbithttps://patchthecve.com/cve/CVE-2025-62237.htmlhttps://patchthecve.com/cve/CVE-2025-62237.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.4: Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 8 through update 92 allows remote attackers to inject arbitrary web script or HTML via ahttps://patchthecve.com/cve/CVE-2025-62240.htmlhttps://patchthecve.com/cve/CVE-2025-62240.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.4: Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 update 35 through update 92, and 7.3 update 25 through update 36 allow remote attackers to inject arbithttps://patchthecve.com/cve/CVE-2025-43771.htmlhttps://patchthecve.com/cve/CVE-2025-43771.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.4: Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.10 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected inthttps://patchthecve.com/cve/CVE-2025-43830.htmlhttps://patchthecve.com/cve/CVE-2025-43830.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.1: Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35 allows remote attackers to inject arbitrary web script or HTML via a crhttps://patchthecve.com/cve/CVE-2025-43829.htmlhttps://patchthecve.com/cve/CVE-2025-43829.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.4: Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.18 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 18 through update 92 allows remote attackers to inject arbitrary web script or Hhttps://patchthecve.com/cve/CVE-2025-43821.htmlhttps://patchthecve.com/cve/CVE-2025-43821.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.4: Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML vihttps://patchthecve.com/cve/CVE-2025-43822.htmlhttps://patchthecve.com/cve/CVE-2025-43822.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.4: Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92 allow remote attackers to inject arbitrary web script or HTML via crafted payload injhttps://patchthecve.com/cve/CVE-2025-43823.htmlhttps://patchthecve.com/cve/CVE-2025-43823.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.4: Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload ihttps://patchthecve.com/cve/CVE-2025-43824.htmlhttps://patchthecve.com/cve/CVE-2025-43824.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.4: The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remotehttps://patchthecve.com/cve/CVE-2025-43825.htmlhttps://patchthecve.com/cve/CVE-2025-43825.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.5: A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA throughttps://patchthecve.com/cve/CVE-2025-43826.htmlhttps://patchthecve.com/cve/CVE-2025-43826.htmlWed, 17 Jun 2026 09:24:36 +0000MEDIUM 5.4: Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allow remote atthttps://patchthecve.com/cve/CVE-2025-43827.htmlhttps://patchthecve.com/cve/CVE-2025-43827.htmlWed, 17 Jun 2026 09:24:36 +0000MEDIUM 4.3: Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported https://patchthecve.com/cve/CVE-2025-43817.htmlhttps://patchthecve.com/cve/CVE-2025-43817.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.1: Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92 allow remote attackers to inject arbitrary web script or HTML via the `redirect` phttps://patchthecve.com/cve/CVE-2025-43813.htmlhttps://patchthecve.com/cve/CVE-2025-43813.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 8.2: Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupporthttps://patchthecve.com/cve/CVE-2025-43812.htmlhttps://patchthecve.com/cve/CVE-2025-43812.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.4: Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted https://patchthecve.com/cve/CVE-2025-43820.htmlhttps://patchthecve.com/cve/CVE-2025-43820.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.4: Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allowhttps://patchthecve.com/cve/CVE-2025-43818.htmlhttps://patchthecve.com/cve/CVE-2025-43818.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.1: Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 36 allows remote attackers to inject arbitrary webhttps://patchthecve.com/cve/CVE-2025-43815.htmlhttps://patchthecve.com/cve/CVE-2025-43815.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.1: Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, and 2023.Q3.5 allows remote attackers to inject arbitrary web script or HTML via the com_liferay_layout_admin_web_portlet_Grouhttps://patchthecve.com/cve/CVE-2025-43811.htmlhttps://patchthecve.com/cve/CVE-2025-43811.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.4: Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.7, and 7.4 update 50 through update 92 allows remote authenticated attackers to inject arbitraryhttps://patchthecve.com/cve/CVE-2025-43816.htmlhttps://patchthecve.com/cve/CVE-2025-43816.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.5: A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2024.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allowshttps://patchthecve.com/cve/CVE-2025-43819.htmlhttps://patchthecve.com/cve/CVE-2025-43819.htmlWed, 17 Jun 2026 09:24:35 +0000MEDIUM 6.5: A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.12 is allow an remote non-authenticated attacker to reuse old userhttps://patchthecve.com/cve/CVE-2025-43779.htmlhttps://patchthecve.com/cve/CVE-2025-43779.htmlSat, 26 Sep 2026 00:10:00 +0000MEDIUM 6.1: A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_commerce_product_definitions_web_internal_pohttps://patchthecve.com/cve/CVE-2025-43814.htmlhttps://patchthecve.com/cve/CVE-2025-43814.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.5: In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions the audit events records a user’s password reminder answer, which allows remote authenticated