Skip to contentLiferay Portal vulnerabilities
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal's unauthenticated users can access loaded files via URL before submitting the object entryCVE-2025-43758Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirectCVE-2025-437605.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal User Enumeration Vulnerability via the Create Account PageCVE-2025-43751Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal's Unlimited File Upload Could Result in DoSCVE-2025-437525.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Reflected Cross-Site Scripting Vulnerability via Form ContainerCVE-2025-43753Fix available2.1 Low
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Username Enumeration VulnerabilityCVE-2025-437546.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Stored Cross-Site Scripting Vulnerability via GroupPagesPortlet_type ParameterCVE-2025-43755Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Reflected Cross-Site Scripting Vulnerability via snippet ParameterCVE-2025-437566.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition ParameterCVE-2025-437574.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data MappingCVE-2025-43746Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to Cross-Site Request ForgeryCVE-2025-43748Fix available7.1 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Unauthenticated File Access via URLCVE-2025-437495.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Unvalidated File UploadCVE-2025-43750Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to Cross-Site Scripting via assetTagNames ParameterCVE-2025-437415.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to Cross-Site Scripting through URLsCVE-2025-43742Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field LabelsCVE-2025-437445.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Enumeration Discrepancy in CalendarsCVE-2025-437435.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal CSRF Vulnerability via Endpoint ParameterCVE-2025-437456.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to Cross-Site Scripting via backURL ParamterCVE-2025-43737Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Reflected Cross-Site Scripting Vulnerability in displayType ParameterCVE-2025-437385.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Email Modification Vulnerability via Calendar PortletCVE-2025-43739Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal has Stored Cross-Site Scripting Vulnerability via Message Boards FeatureCVE-2025-437404.6 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to Cross-Site ScriptingCVE-2025-437316.9 Medium
- liferay dxp, portal +1 moreLiferay Portal Login Bypass VulnerabilityCVE-2025-3639Public exploit2.0 Low
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to Insecure Direct Object ReferenceCVE-2025-43732Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to Cross-Site ScriptingCVE-2025-43733Fix available2.3 Low
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerabilityCVE-2025-43734Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP have a reflected cross-site scripting vulnerabilityCVE-2025-43735Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerabilityCVE-2025-43736Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP vulnerable to Server-Side Request ForgeryCVE-2025-4655Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP vulnerable to Server-Side Request ForgeryCVE-2025-4581Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Reflected XSS in blogs-webCVE-2025-4576Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal CAPTCHA Bypass for Gogo ShellCVE-2025-4604Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreThe fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP...CVE-2025-45992.0 Low
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal SessionClicks does not restrict the saving of request parameters in the HTTP sessionCVE-2025-3526Fix available8.7 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal path traversal vulnerability with the downloading and installation of XugglerCVE-2025-3594Fix available8.6 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal does not limit the depth of a GraphQL queriesCVE-2025-3602Fix available8.7 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Reflected XSS in marketplace-app-manager-webCVE-2025-4388Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Cross-site Scripting vulnerabilityCVE-2025-3760Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Reveals Data via FormsCVE-2025-2565Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)CVE-2025-2536Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy pageCVE-2023-37940Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP vulnerable to Cross-site ScriptingCVE-2024-11993Fix available4.6 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Workflow Component Does Not Check User PermissionsCVE-2024-38002Fix available9.3 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page EditorCVE-2024-26273Fix available8.8 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page EditorCVE-2024-26272Fix available8.8 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to CSRF in the Script ConsoleCVE-2024-8980Fix available9.6 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account WidgetCVE-2024-26271Fix available8.8 High
- esri portal for arcgis, liferay portal +1 moreBUG-000167984 - Portal for ArcGIS has a Local file inclusion (LFI) vulnerabilityCVE-2024-380407.5 High
- esri portal for arcgis, liferay portal +1 moreReflected XSS in Portal for ArcGISCVE-2024-256986.1 Medium
- Show moreLoading…