Skip to content
Liferay vulnerabilities
Newest
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal and DXP do not check permissions of images in a blog entry
CVE-2025-62275
Fix available
6.9 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal and DXP use an incorrect cache-control header
CVE-2025-62276
Fix available
4.6 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal and DXP affected by multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page
CVE-2025-62267
Fix available
4.6 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter
CVE-2025-62264
Fix available
5.1 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal is vulnerable to XSS in the Blogs widget
CVE-2025-62265
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal is vulnerable to DNS rebinding attacks
CVE-2025-62266
Fix available
5.1 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal vulnerable to password enumeration
CVE-2025-62257
Fix available
6.3 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal Vulnerable to CSRF in Headless APIs
CVE-2025-62258
Fix available
7.0 High
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal Does Not Limit Access to APIs Before Email Verification
CVE-2025-62259
Fix available
6.9 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal Vulnerable to DoS via Crafted Headless API Request
CVE-2025-62260
Fix available
7.1 High
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal Stores Password Reset Tokens in Plain Text
CVE-2025-62261
Fix available
6.9 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature
CVE-2025-62262
Fix available
4.6 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal Vulnerable to Cross-Site Scripting
CVE-2025-62263
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter
CVE-2025-62253
Fix available
6.9 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal ComboServlet denial of service via large file combination
CVE-2025-62254
Fix available
6.9 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page
CVE-2025-62255
Fix available
2.0 Low
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal and DXP do not properly restrict access to OpenAPI
CVE-2025-62256
Fix available
6.9 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal and DXP are Missing Authorization in Collection Provider
CVE-2025-62247
2.0 Low
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS)
CVE-2025-62248
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget
CVE-2025-62249
6.9 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal fails to verify messages from the cluster network is trusted
CVE-2025-62250
Fix available
6.9 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay has Incorrect Permission Assignment for Critical Resource
CVE-2025-62251
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key
CVE-2025-62252
Fix available
5.3 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Mentions Web is Vulnerable to Cross-site Scripting
CVE-2025-62246
Fix available
4.8 Medium
-
liferay dxp, digital experience platform +1 more
Liferay Commerce Order Content Web is Vulnerable to Authorization Bypass Through User-Controlled Key
CVE-2025-62241
Fix available
5.3 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Account Admin Web vulnerable to Authorization Bypass Through User-Controlled Key
CVE-2025-62242
Fix available
5.3 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Publications is vulnerable to Incorrect Authorization
CVE-2025-62243
Fix available
5.3 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Publications vulnerable to Authorization Bypass Through User-Controlled Key
CVE-2025-62244
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal is vulnerable to CSRF through publication comments
CVE-2025-62245
Fix available
5.1 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal Commerce is vulnerable to XSS through account "name" field
CVE-2025-62237
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal's Membership page is vulnerable to XSS through “name“ text field
CVE-2025-62238
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal is vulnerable to XSS through its workflow process builder
CVE-2025-62239
Fix available
4.6 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal is vulnerable to XSS through its Calendar Events parameters
CVE-2025-62240
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal Notifications Widget has multiple XSS vulnerabilities through various text fields
CVE-2025-43771
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal Commerce Shop is vulnerable to Stored XSS through SVG file
CVE-2025-43829
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal is vulnerable to Stored XSS through Forms text type field
CVE-2025-43830
Fix available
5.1 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal is vulnerable to XSS through its Commerce Product's Name text field
CVE-2025-43821
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal has multiple Stored XSS vulnerabilities on its View Order page
CVE-2025-43822
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal is vulnerable to XSS through its Commerce Search Result widget
CVE-2025-43823
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Profile Widget does not prevent vCard extension spoofing
CVE-2025-43824
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal exposes sensitive user data through its Freemarker template
CVE-2025-43825
Fix available
4.6 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal Vulnerable to XSS in Web Content translation
CVE-2025-43826
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal Vulnerable to IDOR via audit events
CVE-2025-43827
Fix available
5.3 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter
CVE-2025-43817
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet
CVE-2025-43813
Fix available
6.9 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal vulnerable to cross-site scripting in the web content template
CVE-2025-43812
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal vulnerable to cross-site scripting in the related asset selector
CVE-2025-43811
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal vulnerable to cross-site scripting in the Calendar widget
CVE-2025-43820
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal vulnerable to cross-site scripting in the Calendar widget
CVE-2025-43818
Fix available
4.8 Medium
-
liferay dxp, portal, digital experience platform +2 more
Liferay Portal vulnerable to reflected cross-site scripting on the page configuration page
CVE-2025-43815
Fix available
5.1 Medium
- Show olderLoading…