Liferay vulnerabilities and fixes

CVEs that mention Liferay, ranked by priority. 138 tracked.

Liferay has 138 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 136. Most recent: 2025-10-31. Highest priority: CVE-2025-3594 (score 52/100).

• CVE-2025-3594 CRITICAL 9.8 UPGRADE UPGRADE Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through
• CVE-2025-43766 CRITICAL 9.8 UPGRADE UPGRADE The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0
• CVE-2025-3526 HIGH 7.5 UPGRADE UPGRADE SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA throug
• CVE-2025-43813 HIGH 8.2 UPGRADE UPGRADE Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 throug
• CVE-2025-4388 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Lifera
• CVE-2025-4581 HIGH 8.6 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4
• CVE-2025-62254 HIGH 7.5 DOWNGRADE UPGRADE The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 20
• CVE-2025-3602 HIGH 7.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92,
• CVE-2025-43773 CRITICAL 9.1 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 th
• CVE-2025-43793 HIGH 7.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 t
• CVE-2025-43801 HIGH 7.5 UPGRADE UPGRADE Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and old
• CVE-2025-43796 HIGH 7.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92
• CVE-2025-62260 HIGH 7.5 DOWNGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92,
• CVE-2025-43816 HIGH 7.5 UPGRADE UPGRADE A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older
• CVE-2025-43772 HIGH 7.1 Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, a
• CVE-2025-43790 HIGH 8.1 UPGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay D
• CVE-2025-3586 HIGH 7.2 UPGRADE UPGRADE In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2
• CVE-2025-43750 MEDIUM 6.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4
• CVE-2025-43768 HIGH 7.7 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3
• CVE-2025-4576 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Lifera
• CVE-2025-43799 MEDIUM 6.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 t
• CVE-2025-62256 MEDIUM 5.3 DOWNGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3
• CVE-2025-62257 MEDIUM 5.3 UPGRADE UPGRADE Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions,
• CVE-2025-43747 MEDIUM 6.5 UPGRADE A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due t
• CVE-2025-43762 MEDIUM 6.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4
• CVE-2025-43808 MEDIUM 5.3 UPGRADE UPGRADE The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8,
• CVE-2025-43758 MEDIUM 5.3 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4
• CVE-2025-43763 MEDIUM 6.5 UPGRADE UPGRADE A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and L
• CVE-2025-43798 MEDIUM 6.5 UPGRADE Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allo
• CVE-2025-43814 MEDIUM 6.5 UPGRADE UPGRADE In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2
• CVE-2025-43819 MEDIUM 6.5 UPGRADE UPGRADE A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay
• CVE-2025-43751 MEDIUM 5.3 UPGRADE UPGRADE User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 20
• CVE-2025-43752 MEDIUM 6.5 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4
• CVE-2025-43764 MEDIUM 6.5 UPGRADE UPGRADE Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet
• CVE-2025-43786 MEDIUM 5.3 UPGRADE UPGRADE Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 thro
• CVE-2025-43805 MEDIUM 5.3 UPGRADE UPGRADE Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through
• CVE-2025-62250 MEDIUM 6.5 UPGRADE UPGRADE Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay
• CVE-2024-11993 MEDIUM 6.1 UPGRADE UPGRADE Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7
• CVE-2025-43749 MEDIUM 5.3 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4
• CVE-2025-43754 MEDIUM 5.3 UPGRADE UPGRADE Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 throug
• CVE-2025-43825 MEDIUM 6.5 UPGRADE UPGRADE A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q
• CVE-2025-62251 MEDIUM 6.5 UPGRADE UPGRADE Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4
• CVE-2025-62261 MEDIUM 6.5 DOWNGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.
• CVE-2025-2536 MEDIUM 6.1 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3
• CVE-2025-43745 MEDIUM 6.5 UPGRADE UPGRADE A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2
• CVE-2025-43777 MEDIUM 5.3 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q
• CVE-2025-43784 MEDIUM 6.5 UPGRADE UPGRADE Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 th
• CVE-2025-43789 MEDIUM 5.3 UPGRADE UPGRADE JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4
• CVE-2025-43802 MEDIUM 6.1 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Lifera
• CVE-2025-43748 MEDIUM 6.8 UPGRADE UPGRADE Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Lifer
• CVE-2025-43769 MEDIUM 6.1 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 202
• CVE-2025-43778 MEDIUM 6.1 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 20
• CVE-2025-43779 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Lifera
• CVE-2025-43781 MEDIUM 6.1 UPGRADE UPGRADE Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay
• CVE-2025-43783 MEDIUM 6.1 UPGRADE UPGRADE Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay D
• CVE-2025-43785 MEDIUM 6.1 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP
• CVE-2025-43792 MEDIUM 5.3 UPGRADE UPGRADE Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023
• CVE-2025-43795 MEDIUM 6.1 UPGRADE UPGRADE Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP
• CVE-2025-43800 MEDIUM 6.1 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay
• CVE-2025-43804 MEDIUM 6.1 DOWNGRADE UPGRADE Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Li
• CVE-2025-43815 MEDIUM 6.1 UPGRADE UPGRADE Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102
• CVE-2025-43818 MEDIUM 6.1 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110,
• CVE-2025-43830 MEDIUM 6.1 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Lifera
• CVE-2025-62249 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
• CVE-2025-62253 MEDIUM 6.1 UPGRADE UPGRADE Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsuppo
• CVE-2025-62258 MEDIUM 6.5 DOWNGRADE UPGRADE CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 throug
• CVE-2025-62264 MEDIUM 6.1 DOWNGRADE UPGRADE Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4
• CVE-2025-62266 MEDIUM 6.1 DOWNGRADE UPGRADE By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1
• CVE-2025-62267 MEDIUM 6.1 DOWNGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay
• CVE-2025-3760 MEDIUM 5.4 UPGRADE UPGRADE A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Porta
• CVE-2025-43735 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Lifera
• CVE-2025-43737 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.
• CVE-2025-43742 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
• CVE-2025-43761 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Lifera
• CVE-2025-43765 MEDIUM 6.1 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 202
• CVE-2025-43770 MEDIUM 6.1 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Lifera
• CVE-2025-43791 MEDIUM 6.1 UPGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP
• CVE-2025-43817 MEDIUM 6.1 UPGRADE UPGRADE Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, an
• CVE-2025-4599 MEDIUM 6.1 UPGRADE UPGRADE The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 thr
• CVE-2025-62255 MEDIUM 6.1 UPGRADE UPGRADE Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0
• CVE-2025-43760 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
• CVE-2025-43767 MEDIUM 6.1 UPGRADE UPGRADE Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through
• CVE-2025-43797 MEDIUM 5.4 UPGRADE UPGRADE In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA thro
• CVE-2025-43824 MEDIUM 5.4 UPGRADE UPGRADE The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP
• CVE-2025-4604 MEDIUM 6.1 UPGRADE UPGRADE The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP
• CVE-2025-62243 MEDIUM 5.4 UPGRADE UPGRADE Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.11
• CVE-2023-37940 MEDIUM 4.8 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 throug
• CVE-2025-43734 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
• CVE-2025-43738 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
• CVE-2025-43740 MEDIUM 5.4 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP
• CVE-2025-43741 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
• CVE-2025-43746 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
• CVE-2025-43753 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Lif
• CVE-2025-43755 MEDIUM 5.4 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2
• CVE-2025-43756 MEDIUM 5.4 UPGRADE DOWNGRADE <!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}-->A reflected cross-site scripting (XSS)
• CVE-2025-43757 MEDIUM 5.4 UPGRADE UPGRADE A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Lifera
• CVE-2025-43771 MEDIUM 5.4 UPGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 th
• CVE-2025-43775 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 202
• CVE-2025-43776 MEDIUM 5.4 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 20
• CVE-2025-43782 MEDIUM 4.3 UPGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay D
• CVE-2025-43787 MEDIUM 5.4 UPGRADE UPGRADE A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 20
• CVE-2025-43807 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.
• CVE-2025-43811 MEDIUM 5.4 UPGRADE UPGRADE Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3
• CVE-2025-43812 MEDIUM 5.4 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111,
• CVE-2025-43820 MEDIUM 5.4 UPGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in L
• CVE-2025-43821 MEDIUM 5.4 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4
• CVE-2025-43822 MEDIUM 5.4 UPGRADE UPGRADE Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and L
• CVE-2025-43823 MEDIUM 5.4 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through
• CVE-2025-43826 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7
• CVE-2025-43829 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.1
• CVE-2025-62237 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 throug
• CVE-2025-62238 MEDIUM 5.4 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7
• CVE-2025-62239 MEDIUM 5.4 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.
• CVE-2025-62240 MEDIUM 5.4 UPGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.
• CVE-2025-62246 MEDIUM 5.4 UPGRADE UPGRADE Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and olde
• CVE-2025-62259 MEDIUM 5.4 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023
• CVE-2025-62263 MEDIUM 5.4 DOWNGRADE UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP
• CVE-2025-62265 MEDIUM 5.4 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and ol
• CVE-2025-43744 MEDIUM 5.4 UPGRADE UPGRADE A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Lif
• CVE-2025-43827 MEDIUM 4.3 UPGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.
• CVE-2025-4655 MEDIUM 5.0 UPGRADE UPGRADE SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.
• CVE-2025-62242 MEDIUM 4.3 DOWNGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through
• CVE-2025-2565 MEDIUM 4.3 UPGRADE UPGRADE The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.
• CVE-2025-43736 MEDIUM 4.3 UPGRADE UPGRADE A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and L
• CVE-2025-43739 MEDIUM 4.3 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4
• CVE-2025-43743 MEDIUM 4.3 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4
• CVE-2025-43788 MEDIUM 4.3 UPGRADE UPGRADE The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1
• CVE-2025-43794 MEDIUM 4.8 UPGRADE UPGRADE Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupport
• CVE-2025-43803 MEDIUM 4.3 UPGRADE UPGRADE Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 th
• CVE-2025-43810 MEDIUM 4.3 UPGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 throug
• CVE-2025-62241 MEDIUM 4.3 DOWNGRADE Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through
• CVE-2025-62244 MEDIUM 4.3 UPGRADE UPGRADE Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.11
• CVE-2025-62252 MEDIUM 4.3 UPGRADE UPGRADE Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older uns
• CVE-2025-43806 MEDIUM 4.3 UPGRADE UPGRADE Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1
• CVE-2025-43809 MEDIUM 4.3 UPGRADE UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.
• CVE-2025-62245 MEDIUM 4.3 UPGRADE UPGRADE Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 202
• CVE-2025-62262 MEDIUM 4.4 DOWNGRADE UPGRADE Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4
• CVE-2025-43759 LOW 2.7 UPGRADE UPGRADE Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 thro

FAQ

How do I fix Liferay vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Liferay being exploited right now?

None of the tracked Liferay CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Liferay CVE should I patch first?

CVE-2025-3594 currently ranks highest (52/100): Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through .

RSS feed for Liferay · ← Back to latest CVEs