CVEs published by Liferay Inc.

CVEs published by Liferay Inc. (CVE Numbering Authority). 183 tracked.

CVE-2025-43813 HIGH 8.2 UPGRADE UPGRADE Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 throug
CVE-2025-62254 HIGH 7.5 DOWNGRADE UPGRADE The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 20
CVE-2025-43773 CRITICAL 9.1 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 th
CVE-2025-43793 HIGH 7.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 t
CVE-2025-43801 HIGH 7.5 UPGRADE UPGRADE Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and old
CVE-2025-62260 HIGH 7.5 DOWNGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92,
CVE-2025-43796 HIGH 7.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92
CVE-2025-43816 HIGH 7.5 UPGRADE UPGRADE A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older
CVE-2025-43772 HIGH 7.1 Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, a
CVE-2025-43790 HIGH 8.1 UPGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay D
CVE-2025-3586 HIGH 7.2 UPGRADE UPGRADE In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2
CVE-2025-62256 MEDIUM 5.3 DOWNGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3
CVE-2025-43799 MEDIUM 6.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 t
CVE-2025-43808 MEDIUM 5.3 UPGRADE UPGRADE The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8,
CVE-2025-43814 MEDIUM 6.5 UPGRADE UPGRADE In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2
CVE-2025-43763 MEDIUM 6.5 UPGRADE UPGRADE A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and L
CVE-2025-62250 MEDIUM 6.5 UPGRADE UPGRADE Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay
CVE-2025-43786 MEDIUM 5.3 UPGRADE UPGRADE Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 thro
CVE-2025-43805 MEDIUM 5.3 UPGRADE UPGRADE Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through
CVE-2025-62261 MEDIUM 6.5 DOWNGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.
CVE-2025-62251 MEDIUM 6.5 UPGRADE UPGRADE Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4
CVE-2025-43825 MEDIUM 6.5 UPGRADE UPGRADE A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q
CVE-2025-43777 MEDIUM 5.3 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q
CVE-2025-43789 MEDIUM 5.3 UPGRADE UPGRADE JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4
CVE-2025-43802 MEDIUM 6.1 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Lifera
CVE-2025-62253 MEDIUM 6.1 UPGRADE UPGRADE Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsuppo
CVE-2025-62258 MEDIUM 6.5 DOWNGRADE UPGRADE CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 throug
CVE-2025-62264 MEDIUM 6.1 DOWNGRADE UPGRADE Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4
CVE-2025-62267 MEDIUM 6.1 DOWNGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay
CVE-2025-62249 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
CVE-2025-43830 MEDIUM 6.1 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Lifera
CVE-2025-43815 MEDIUM 6.1 UPGRADE UPGRADE Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102
CVE-2025-43818 MEDIUM 6.1 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110,
CVE-2025-43778 MEDIUM 6.1 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 20
CVE-2025-43781 MEDIUM 6.1 UPGRADE UPGRADE Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay
CVE-2025-43795 MEDIUM 6.1 UPGRADE UPGRADE Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP
CVE-2025-43792 MEDIUM 5.3 UPGRADE UPGRADE Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023
CVE-2025-43800 MEDIUM 6.1 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay
CVE-2025-43804 MEDIUM 6.1 DOWNGRADE UPGRADE Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Li
CVE-2025-62255 MEDIUM 6.1 UPGRADE UPGRADE Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0
CVE-2025-43817 MEDIUM 6.1 UPGRADE UPGRADE Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, an
CVE-2025-43791 MEDIUM 6.1 UPGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP
CVE-2025-62243 MEDIUM 5.4 UPGRADE UPGRADE Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.11
CVE-2025-43824 MEDIUM 5.4 UPGRADE UPGRADE The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP
CVE-2025-43797 MEDIUM 5.4 UPGRADE UPGRADE In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA thro
CVE-2025-62263 MEDIUM 5.4 DOWNGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP
CVE-2025-62259 MEDIUM 5.4 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023
CVE-2025-62246 MEDIUM 5.4 UPGRADE UPGRADE Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and olde
CVE-2025-43823 MEDIUM 5.4 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through
CVE-2025-43822 MEDIUM 5.4 UPGRADE UPGRADE Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and L
CVE-2025-43821 MEDIUM 5.4 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4
CVE-2025-43829 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.1
CVE-2025-43771 MEDIUM 5.4 UPGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 th
CVE-2025-62240 MEDIUM 5.4 UPGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.
CVE-2025-62237 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 throug
CVE-2025-62238 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7
CVE-2025-62239 MEDIUM 5.4 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.
CVE-2025-43807 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.
CVE-2025-43811 MEDIUM 5.4 UPGRADE UPGRADE Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3
CVE-2025-43820 MEDIUM 5.4 UPGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in L
CVE-2025-43812 MEDIUM 5.4 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111,
CVE-2025-43776 MEDIUM 5.4 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 20
CVE-2025-43775 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 202
CVE-2025-43782 MEDIUM 4.3 UPGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay D
CVE-2025-43787 MEDIUM 5.4 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 20
CVE-2025-62242 MEDIUM 4.3 DOWNGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through
CVE-2025-62244 MEDIUM 4.3 UPGRADE UPGRADE Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.11
CVE-2025-62252 MEDIUM 4.3 UPGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older uns
CVE-2025-43803 MEDIUM 4.3 UPGRADE UPGRADE Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 th
CVE-2025-43810 MEDIUM 4.3 UPGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 throug
CVE-2025-43788 MEDIUM 4.3 UPGRADE UPGRADE The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1
CVE-2025-43794 MEDIUM 4.8 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupport
CVE-2025-43806 MEDIUM 4.3 UPGRADE UPGRADE Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1
CVE-2025-62245 MEDIUM 4.3 UPGRADE UPGRADE Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 202
CVE-2025-43809 MEDIUM 4.3 UPGRADE UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.
CVE-2025-62262 MEDIUM 4.4 DOWNGRADE UPGRADE Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4
CVE-2025-62257 MEDIUM 5.3 UPGRADE UPGRADE Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions,
CVE-2025-62266 MEDIUM 6.1 DOWNGRADE UPGRADE By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1
CVE-2025-62265 MEDIUM 5.4 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and ol
CVE-2025-62241 MEDIUM 4.3 DOWNGRADE Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through
CVE-2025-43784 MEDIUM 6.5 UPGRADE UPGRADE Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 th
CVE-2025-43779 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Lifera
CVE-2025-43785 MEDIUM 6.1 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP
CVE-2025-43783 MEDIUM 6.1 UPGRADE UPGRADE Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay D
CVE-2025-4655 MEDIUM 5.0 UPGRADE UPGRADE SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.
CVE-2025-4604 MEDIUM 6.1 UPGRADE UPGRADE The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP
CVE-2025-4599 MEDIUM 6.1 UPGRADE UPGRADE The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 thr
CVE-2025-4581 HIGH 8.6 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4
CVE-2025-4576 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Lifera
CVE-2025-4388 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Lifera
CVE-2025-43827 MEDIUM 4.3 UPGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.
CVE-2025-43826 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7
CVE-2025-43819 MEDIUM 6.5 UPGRADE UPGRADE A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay
CVE-2025-43798 MEDIUM 6.5 UPGRADE Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allo
CVE-2025-43770 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Lifera
CVE-2025-43769 MEDIUM 6.1 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 202
CVE-2025-43768 HIGH 7.7 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3
CVE-2025-43767 MEDIUM 6.1 UPGRADE UPGRADE Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through
CVE-2025-43766 CRITICAL 9.8 UPGRADE UPGRADE The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0
CVE-2025-43765 MEDIUM 6.1 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 202
CVE-2025-43764 MEDIUM 6.5 UPGRADE UPGRADE Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet
CVE-2025-43762 MEDIUM 6.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4
CVE-2025-43761 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Lifera
CVE-2025-43760 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
CVE-2025-43759 LOW 2.7 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 thro
CVE-2025-43758 MEDIUM 5.3 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4
CVE-2025-43757 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
CVE-2025-43756 MEDIUM 5.4 UPGRADE DOWNGRADE A reflected cross-site scripting (XSS)
CVE-2025-43755 MEDIUM 5.4 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2
CVE-2025-43754 MEDIUM 5.3 UPGRADE UPGRADE Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 throug
CVE-2025-43753 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Lif
CVE-2025-43752 MEDIUM 6.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4
CVE-2025-43751 MEDIUM 5.3 UPGRADE UPGRADE User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 20
CVE-2025-43750 MEDIUM 6.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4
CVE-2025-43749 MEDIUM 5.3 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4
CVE-2025-43748 MEDIUM 6.8 UPGRADE UPGRADE Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Lifer
CVE-2025-43747 MEDIUM 6.5 UPGRADE A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due t
CVE-2025-43746 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
CVE-2025-43745 MEDIUM 6.5 UPGRADE UPGRADE A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2
CVE-2025-43744 MEDIUM 5.4 UPGRADE UPGRADE A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Lif
CVE-2025-43743 MEDIUM 4.3 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4
CVE-2025-43742 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
CVE-2025-43741 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
CVE-2025-43740 MEDIUM 5.4 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP
CVE-2025-43739 MEDIUM 4.3 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4
CVE-2025-43738 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
CVE-2025-43737 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.
CVE-2025-43736 MEDIUM 4.3 UPGRADE UPGRADE A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and L
CVE-2025-43735 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Lifera
CVE-2025-43734 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
CVE-2025-3760 MEDIUM 5.4 UPGRADE UPGRADE A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Porta
CVE-2025-3602 HIGH 7.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92,
CVE-2025-3594 CRITICAL 9.8 UPGRADE UPGRADE Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through
CVE-2025-3526 HIGH 7.5 UPGRADE UPGRADE SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA throug
CVE-2025-2565 MEDIUM 4.3 UPGRADE UPGRADE The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.
CVE-2025-2536 MEDIUM 6.1 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3
CVE-2024-26270 MEDIUM 6.5 UPGRADE DOWNGRADE The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5,
CVE-2024-26269 CRITICAL 9.6 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 throug
CVE-2024-26268 MEDIUM 5.3 UPGRADE UPGRADE User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and L
CVE-2024-26267 MEDIUM 5.3 UPGRADE UPGRADE In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26
CVE-2024-26266 CRITICAL 9.0 UPGRADE UPGRADE Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older
CVE-2024-26265 MEDIUM 5.0 UPGRADE UPGRADE The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Lifera
CVE-2024-25610 CRITICAL 9.0 UPGRADE UPGRADE In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9,
CVE-2024-25609 MEDIUM 6.1 UPGRADE UPGRADE HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay
CVE-2024-25608 MEDIUM 6.1 UPGRADE UPGRADE HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay
CVE-2024-25607 HIGH 8.1 UPGRADE UPGRADE The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older
CVE-2024-25606 HIGH 8.0 UPGRADE UPGRADE XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4
CVE-2024-25605 MEDIUM 5.3 UPGRADE UPGRADE The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.
CVE-2024-25604 MEDIUM 6.5 UPGRADE UPGRADE Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before servi
CVE-2024-25603 CRITICAL 9.0 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal

← Back to latest CVEs