Skip to contentLiferay vulnerabilities
Newest
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP vulnerable to a memory leakCVE-2025-43816Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP does not properly expire sessionsCVE-2025-43819Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3...CVE-2025-437796.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP audit events record password reminder answersCVE-2025-43814Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP allows users to add a note to a different virtual instanceCVE-2025-43810Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP does not properly check permission with import and export tasksCVE-2025-43806Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay has a stored cross-site scripting (XSS) vulnerability via a a publication’s “Name” text fieldCVE-2025-43807Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Commerce component has Incorrect Permission Assignment for Critical ResourceCVE-2025-43808Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Cross-Site Request Forgery (CSRF) vulnerabilityCVE-2025-43809Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Contacts Center widget has insecure direct object referenceCVE-2025-43803Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay search widget vulnerable to Cross-site ScriptingCVE-2025-43804Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal allows remote attackers to view display page templates via crafted URLsCVE-2025-43805Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal has unchecked input for loop condition vulnerability in XML-RPCCVE-2025-43801Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Stored Cross-site Scripting vulnerabilityCVE-2025-43802Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay has Insecure Default Initialization of Resource issueCVE-2025-43797Fix available5.3 Medium
- liferay dxp, digital experience platform +1 moreLiferay DXP Missing Critical Step in AuthenticationCVE-2025-43798Fix available2.1 Low
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Uses Default PasswordCVE-2025-43799Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Cross-site Scripting (XSS) vulnerabilityCVE-2025-43800Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to Cross-site ScriptingCVE-2025-43791Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal has External Control of System or Configuration SettingsCVE-2025-43792Fix available2.3 Low
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal has Improper Validation of Specified Quantity in InputCVE-2025-43793Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal has stored cross-site scripting (XSS) vulnerabilityCVE-2025-43794Fix available4.6 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal's System, Instance and Site Settings are vulnerable to Open RedirectCVE-2025-43795Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal: Missing Rate Limiting in GraphQL Endpoint Enables Resource Exhaustion AttackCVE-2025-43796Fix available7.1 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal's selection modal is vulnerable to XSSCVE-2025-43787Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal's Organization Selector exposes organization data to remote authenticated usersCVE-2025-43788Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal JSON Web Services Direct Class Invocation Enables Service Access Policy ExecutionCVE-2025-43789Fix available1.0 Low
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to Insecure Direct Object Reference (IDOR) attack through Authentication BypassCVE-2025-43790Fix available7.4 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal API Allows Authenticated Users to Access Workflow Definitions by NameCVE-2025-43782Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to Reflected XSS attack through get_editor pathCVE-2025-43783Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal's Incorrect Authorization vulnerability can lead to guest users to obtaining sensitive dataCVE-2025-43784Fix available6.2 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP vulnerable to Stored Cross-site ScriptingCVE-2025-43785Fix available4.6 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal exposes ERC which can lead to exploit the time response attackCVE-2025-43786Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to XSS attack through its search bar portletCVE-2025-43781Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to XSS attacks via its remote app title fieldCVE-2025-43775Fix available4.6 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP vulnerable to store Cross-site ScriptingCVE-2025-43776Fix available4.6 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal exposes 500 status when attempting login with a deleted client secretCVE-2025-43777Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to XSS attack through fieldset name in Kaleo Forms AdminCVE-2025-43778Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to SSRF through custom object attachment fieldsCVE-2025-43763Fix available4.8 Medium
- liferay dxp, portal +1 moreLiferay Portal Vulnerable to Denial of Service in Kaleo Forms AdminCVE-2025-43772Fix available7.1 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP Instance Admin can execute code using Objects Actions and ValidationsCVE-2025-3586Fix available7.5 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal allows improper access through the expandoTableLocalServiceCVE-2025-43773Fix available4.6 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal ReDoS with Role Name search in KaleoDesignerPortletCVE-2025-43764Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal stored cross-site scripting in text field of the web content structureCVE-2025-43765Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal allows unrestricted upload of file in the style books componentCVE-2025-43766Fix available6.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal allows open redirect in /c/portal/edit_info_item parameter redirectCVE-2025-43767Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal JSONWS API endpoint shares sensitive informationCVE-2025-43768Fix available5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to Stored XSS in Components portletCVE-2025-43769Fix available4.6 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to Reflected XSS with the referer and forward parameterCVE-2025-43770Fix available6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Reflected XSS in CKeditor 4.21.0 endpointCVE-2025-43761Fix available6.9 Medium
- Show moreLoading…