Skip to contentLiferay Dxp vulnerabilities
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP do not check permissions of images in a blog entryCVE-2025-62275Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP use an incorrect cache-control headerCVE-2025-62276Fix available4.6 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP affected by multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure pageCVE-2025-62267Fix available4.6 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to Reflected XSS via the selectedLanguageId ParameterCVE-2025-62264Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to XSS in the Blogs widgetCVE-2025-62265Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to DNS rebinding attacksCVE-2025-62266Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to password enumerationCVE-2025-62257Fix available6.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to CSRF in Headless APIsCVE-2025-62258Fix available7.0 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Does Not Limit Access to APIs Before Email VerificationCVE-2025-62259Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to DoS via Crafted Headless API RequestCVE-2025-62260Fix available7.1 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Stores Password Reset Tokens in Plain TextCVE-2025-62261Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import FeatureCVE-2025-62262Fix available4.6 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to Cross-Site ScriptingCVE-2025-62263Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameterCVE-2025-62253Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal ComboServlet denial of service via large file combinationCVE-2025-62254Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article pageCVE-2025-62255Fix available2.0 Low
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP do not properly restrict access to OpenAPICVE-2025-62256Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP are Missing Authorization in Collection ProviderCVE-2025-622472.0 Low
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS)CVE-2025-622484.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gagetCVE-2025-622496.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal fails to verify messages from the cluster network is trustedCVE-2025-62250Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay has Incorrect Permission Assignment for Critical ResourceCVE-2025-62251Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay is Vulnerable to Authorization Bypass Through User-Controlled KeyCVE-2025-62252Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Mentions Web is Vulnerable to Cross-site ScriptingCVE-2025-62246Fix available4.8 Medium
- liferay dxp, digital experience platform +1 moreLiferay Commerce Order Content Web is Vulnerable to Authorization Bypass Through User-Controlled KeyCVE-2025-62241Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Account Admin Web vulnerable to Authorization Bypass Through User-Controlled KeyCVE-2025-62242Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Publications is vulnerable to Incorrect AuthorizationCVE-2025-62243Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Publications vulnerable to Authorization Bypass Through User-Controlled KeyCVE-2025-62244Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to CSRF through publication commentsCVE-2025-62245Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Commerce is vulnerable to XSS through account "name" fieldCVE-2025-62237Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal's Membership page is vulnerable to XSS through “name“ text fieldCVE-2025-62238Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to XSS through its workflow process builderCVE-2025-62239Fix available4.6 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to XSS through its Calendar Events parametersCVE-2025-62240Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Notifications Widget has multiple XSS vulnerabilities through various text fieldsCVE-2025-43771Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Commerce Shop is vulnerable to Stored XSS through SVG fileCVE-2025-43829Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to Stored XSS through Forms text type fieldCVE-2025-43830Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to XSS through its Commerce Product's Name text fieldCVE-2025-43821Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal has multiple Stored XSS vulnerabilities on its View Order pageCVE-2025-43822Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to XSS through its Commerce Search Result widgetCVE-2025-43823Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Profile Widget does not prevent vCard extension spoofingCVE-2025-43824Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal exposes sensitive user data through its Freemarker templateCVE-2025-43825Fix available4.6 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to XSS in Web Content translationCVE-2025-43826Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to IDOR via audit eventsCVE-2025-43827Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameterCVE-2025-43817Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to path traversal and denial-of-service in the ComboServletCVE-2025-43813Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to cross-site scripting in the web content templateCVE-2025-43812Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to cross-site scripting in the related asset selectorCVE-2025-43811Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to cross-site scripting in the Calendar widgetCVE-2025-43820Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to cross-site scripting in the Calendar widgetCVE-2025-43818Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to reflected cross-site scripting on the page configuration pageCVE-2025-43815Fix available5.1 Medium
- Show olderLoading…