liferay portal vulnerabilities and fixes

Recent CVEs affecting liferay portal, with upgrade or downgrade steps. 168 tracked.

Also searched as: liferayportal.

liferay portal has 168 tracked vulnerabilities, 16 critical. A fixed release or vendor patch exists for 168. Most recent: 2025-10-31. Highest priority: CVE-2025-3594 (score 52/100).

CVE-2025-43813 HIGH 8.2 UPGRADE UPGRADE Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 throug
CVE-2025-62254 HIGH 7.5 DOWNGRADE UPGRADE The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 20
CVE-2025-43773 CRITICAL 9.1 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 th
CVE-2025-43793 HIGH 7.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 t
CVE-2025-43801 HIGH 7.5 UPGRADE UPGRADE Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and old
CVE-2025-62260 HIGH 7.5 DOWNGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92,
CVE-2025-43796 HIGH 7.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92
CVE-2025-43816 HIGH 7.5 UPGRADE UPGRADE A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older
CVE-2025-43790 HIGH 8.1 UPGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay D
CVE-2025-3586 HIGH 7.2 UPGRADE UPGRADE In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2
CVE-2025-62256 MEDIUM 5.3 DOWNGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3
CVE-2025-43799 MEDIUM 6.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 t
CVE-2025-43808 MEDIUM 5.3 UPGRADE UPGRADE The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8,
CVE-2025-43814 MEDIUM 6.5 UPGRADE UPGRADE In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2
CVE-2025-43763 MEDIUM 6.5 UPGRADE UPGRADE A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and L
CVE-2025-62250 MEDIUM 6.5 UPGRADE UPGRADE Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay
CVE-2025-43786 MEDIUM 5.3 UPGRADE UPGRADE Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 thro
CVE-2025-43805 MEDIUM 5.3 UPGRADE UPGRADE Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through
CVE-2025-62261 MEDIUM 6.5 DOWNGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.
CVE-2025-62251 MEDIUM 6.5 UPGRADE UPGRADE Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4
CVE-2025-43825 MEDIUM 6.5 UPGRADE UPGRADE A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q
CVE-2025-43777 MEDIUM 5.3 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q
CVE-2025-43789 MEDIUM 5.3 UPGRADE UPGRADE JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4
CVE-2025-43802 MEDIUM 6.1 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Lifera
CVE-2025-62253 MEDIUM 6.1 UPGRADE UPGRADE Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsuppo
CVE-2025-62258 MEDIUM 6.5 DOWNGRADE UPGRADE CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 throug
CVE-2025-62264 MEDIUM 6.1 DOWNGRADE UPGRADE Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4
CVE-2025-62267 MEDIUM 6.1 DOWNGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay
CVE-2025-62249 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
CVE-2025-43830 MEDIUM 6.1 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Lifera
CVE-2025-43815 MEDIUM 6.1 UPGRADE UPGRADE Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102
CVE-2025-43818 MEDIUM 6.1 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110,
CVE-2025-43778 MEDIUM 6.1 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 20
CVE-2025-43781 MEDIUM 6.1 UPGRADE UPGRADE Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay
CVE-2025-43795 MEDIUM 6.1 UPGRADE UPGRADE Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP
CVE-2025-43792 MEDIUM 5.3 UPGRADE UPGRADE Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023
CVE-2025-43800 MEDIUM 6.1 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay
CVE-2025-43804 MEDIUM 6.1 DOWNGRADE UPGRADE Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Li
CVE-2025-62255 MEDIUM 6.1 UPGRADE UPGRADE Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0
CVE-2025-43817 MEDIUM 6.1 UPGRADE UPGRADE Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, an
CVE-2025-43791 MEDIUM 6.1 UPGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP
CVE-2025-62243 MEDIUM 5.4 UPGRADE UPGRADE Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.11
CVE-2025-43824 MEDIUM 5.4 UPGRADE UPGRADE The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP
CVE-2025-43797 MEDIUM 5.4 UPGRADE UPGRADE In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA thro
CVE-2025-62263 MEDIUM 5.4 DOWNGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP
CVE-2025-62259 MEDIUM 5.4 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023
CVE-2025-62246 MEDIUM 5.4 UPGRADE UPGRADE Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and olde
CVE-2025-43823 MEDIUM 5.4 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through
CVE-2025-43822 MEDIUM 5.4 UPGRADE UPGRADE Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and L
CVE-2025-43821 MEDIUM 5.4 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4
CVE-2025-43829 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.1
CVE-2025-43771 MEDIUM 5.4 UPGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 th
CVE-2025-62240 MEDIUM 5.4 UPGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.
CVE-2025-62237 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 throug
CVE-2025-62238 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7
CVE-2025-62239 MEDIUM 5.4 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.
CVE-2025-43807 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.
CVE-2025-43811 MEDIUM 5.4 UPGRADE UPGRADE Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3
CVE-2025-43820 MEDIUM 5.4 UPGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in L
CVE-2025-43812 MEDIUM 5.4 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111,
CVE-2025-43776 MEDIUM 5.4 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 20
CVE-2025-43775 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 202
CVE-2025-43782 MEDIUM 4.3 UPGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay D
CVE-2025-43787 MEDIUM 5.4 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 20
CVE-2025-62242 MEDIUM 4.3 DOWNGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through
CVE-2025-62244 MEDIUM 4.3 UPGRADE UPGRADE Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.11
CVE-2025-62252 MEDIUM 4.3 UPGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older uns
CVE-2025-43803 MEDIUM 4.3 UPGRADE UPGRADE Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 th
CVE-2025-43810 MEDIUM 4.3 UPGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 throug
CVE-2025-43788 MEDIUM 4.3 UPGRADE UPGRADE The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1
CVE-2025-43794 MEDIUM 4.8 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupport
CVE-2025-43806 MEDIUM 4.3 UPGRADE UPGRADE Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1
CVE-2025-62245 MEDIUM 4.3 UPGRADE UPGRADE Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 202
CVE-2025-43809 MEDIUM 4.3 UPGRADE UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.
CVE-2025-62262 MEDIUM 4.4 DOWNGRADE UPGRADE Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4
CVE-2025-62257 MEDIUM 5.3 UPGRADE UPGRADE Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions,
CVE-2025-62266 MEDIUM 6.1 DOWNGRADE UPGRADE By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1
CVE-2025-62265 MEDIUM 5.4 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and ol
CVE-2025-43784 MEDIUM 6.5 UPGRADE UPGRADE Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 th
CVE-2025-43779 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Lifera
CVE-2025-43785 MEDIUM 6.1 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP
CVE-2025-43783 MEDIUM 6.1 UPGRADE UPGRADE Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay D
CVE-2025-4655 MEDIUM 5.0 UPGRADE UPGRADE SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.
CVE-2025-4604 MEDIUM 6.1 UPGRADE UPGRADE The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP
CVE-2025-4599 MEDIUM 6.1 UPGRADE UPGRADE The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 thr
CVE-2025-4581 HIGH 8.6 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4
CVE-2025-4576 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Lifera
CVE-2025-4388 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Lifera
CVE-2025-43827 MEDIUM 4.3 UPGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.
CVE-2025-43826 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7
CVE-2025-43819 MEDIUM 6.5 UPGRADE UPGRADE A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay
CVE-2025-43770 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Lifera
CVE-2025-43769 MEDIUM 6.1 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 202
CVE-2025-43768 HIGH 7.7 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3
CVE-2025-43767 MEDIUM 6.1 UPGRADE UPGRADE Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through
CVE-2025-43766 CRITICAL 9.8 UPGRADE UPGRADE The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0
CVE-2025-43765 MEDIUM 6.1 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 202
CVE-2025-43764 MEDIUM 6.5 UPGRADE UPGRADE Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet
CVE-2025-43762 MEDIUM 6.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4
CVE-2025-43761 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Lifera
CVE-2025-43760 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
CVE-2025-43759 LOW 2.7 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 thro
CVE-2025-43758 MEDIUM 5.3 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4
CVE-2025-43757 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
CVE-2025-43756 MEDIUM 5.4 UPGRADE DOWNGRADE A reflected cross-site scripting (XSS)
CVE-2025-43755 MEDIUM 5.4 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2
CVE-2025-43754 MEDIUM 5.3 UPGRADE UPGRADE Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 throug
CVE-2025-43753 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Lif
CVE-2025-43752 MEDIUM 6.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4
CVE-2025-43751 MEDIUM 5.3 UPGRADE UPGRADE User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 20
CVE-2025-43750 MEDIUM 6.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4
CVE-2025-43749 MEDIUM 5.3 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4
CVE-2025-43748 MEDIUM 6.8 UPGRADE UPGRADE Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Lifer
CVE-2025-43746 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
CVE-2025-43745 MEDIUM 6.5 UPGRADE UPGRADE A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2
CVE-2025-43744 MEDIUM 5.4 UPGRADE UPGRADE A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Lif
CVE-2025-43743 MEDIUM 4.3 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4
CVE-2025-43742 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
CVE-2025-43741 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
CVE-2025-43740 MEDIUM 5.4 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP
CVE-2025-43739 MEDIUM 4.3 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4
CVE-2025-43738 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
CVE-2025-43737 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.
CVE-2025-43736 MEDIUM 4.3 UPGRADE UPGRADE A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and L
CVE-2025-43735 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Lifera
CVE-2025-43734 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
CVE-2025-3760 MEDIUM 5.4 UPGRADE UPGRADE A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Porta
CVE-2025-3602 HIGH 7.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92,
CVE-2025-3594 CRITICAL 9.8 UPGRADE UPGRADE Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through
CVE-2025-3526 HIGH 7.5 UPGRADE UPGRADE SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA throug
CVE-2025-2565 MEDIUM 4.3 UPGRADE UPGRADE The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.
CVE-2025-2536 MEDIUM 6.1 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3
CVE-2024-26270 MEDIUM 6.5 UPGRADE DOWNGRADE The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5,
CVE-2024-26269 CRITICAL 9.6 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 throug
CVE-2024-26268 MEDIUM 5.3 UPGRADE UPGRADE User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and L
CVE-2024-26267 MEDIUM 5.3 UPGRADE UPGRADE In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26
CVE-2024-26266 CRITICAL 9.0 UPGRADE UPGRADE Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older
CVE-2024-26265 MEDIUM 5.0 UPGRADE UPGRADE The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Lifera
CVE-2024-25610 CRITICAL 9.0 UPGRADE UPGRADE In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9,
CVE-2024-25609 MEDIUM 6.1 UPGRADE UPGRADE HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay
CVE-2024-25608 MEDIUM 6.1 UPGRADE UPGRADE HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay
CVE-2024-25607 HIGH 8.1 UPGRADE UPGRADE The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older
CVE-2024-25606 HIGH 8.0 UPGRADE UPGRADE XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4
CVE-2024-25605 MEDIUM 5.3 UPGRADE UPGRADE The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.
CVE-2024-25604 MEDIUM 6.5 UPGRADE UPGRADE Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before servi
CVE-2024-25603 CRITICAL 9.0 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal
CVE-2024-25602 CRITICAL 9.0 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0
CVE-2024-25601 CRITICAL 9.0 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Porta
CVE-2024-25152 CRITICAL 9.0 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2,
CVE-2024-25151 MEDIUM 5.4 UPGRADE UPGRADE The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3

FAQ

How do I fix liferay portal vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is liferay portal being exploited right now?

None of the tracked liferay portal CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which liferay portal CVE should I patch first?

CVE-2025-3594 currently ranks highest (52/100): Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through .

RSS feed for liferay portal · ← Back to latest CVEs