DE
Product
Digital Experience Platform
264
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 35Medium 224Low 2
Watch
Add Digital Experience Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-43766 | 9.8 | Aug 23 | The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through… Affected: 2024.Q1.1 before 2024.Q1.14; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-3594 | 9.8 | Jun 16 | Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 34, and older… Affected: 7.0 through 7.2; 7.3; 7.3; 7.3; 7.3; 7.3; +29 more |
| CVE-2025-43773 | 9.1 | Aug 29 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through… Affected: 2024.Q1.1 before 2024.Q1.19; 2024.q2.0 through 2024.q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.q4.0 through 2024.q4.7; 2025.Q1.0 before 2025.Q1.15; 7.4; +1 more |
| CVE-2024-38002 | 8.8 | Oct 22 | The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA… Affected: 2023.q3.1 before 2023.q3.9; 2023.q4.0 before 2023.q4.6; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2024-26273 | 8.8 | Oct 22 | Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1… Affected: 2023.q3.1 before 2023.q3.6; 2023.q4.0 before 2023.q4.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2024-26272 | 8.8 | Oct 22 | Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1… Affected: 2023.q3.1 before 2023.q3.6; 2023.q4.0 before 2023.q4.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2024-26271 | 8.8 | Oct 22 | Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1… Affected: 2023.q3.1 before 2023.q3.6; 2023.q4.0 before 2023.q4.3; 7.3; 7.3; 7.3; 7.3; +18 more |
| CVE-2022-42121 | 8.8 | Nov 15 | A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack… Affected: 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; +34 more |
| CVE-2020-15841 | 8.8 | Jul 20 | Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2024-25606 | 8.7 | Feb 20 | XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +34 more |
| CVE-2025-4581 | 8.6 | Aug 9 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 2024.q1.1 through 2024.q1.15; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7; 2025.q1.0 through 2025.q1.4; 7.4 |
| CVE-2025-43813 | 8.2 | Sep 29 | Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP… Affected: before 7.3; 2023.q3.1 before 2023.q3.9; 2023.Q4.0 before 2023.Q4.5; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43790 | 8.1 | Sep 11 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4… Affected: 2024.Q1.1 before 2024.Q1.13; 2024.Q2.0 before 2024.Q2.7; 7.4 |
| CVE-2024-25148 | 8.1 | Feb 8 | In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the… Affected: 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +9 more |
| CVE-2023-33945 | 8.1 | May 24 | SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows… Affected: 7.3; 7.3; 7.3; 7.3; 7.3; 7.4; +16 more |
| CVE-2020-15842 | 8.1 | Jul 20 | Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2025-43768 | 7.7 | Aug 23 | Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and… Affected: 2024.Q1.1 before 2024.Q1.16; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 7.4; 7.4; 7.4; +4 more |
| CVE-2025-62260 | 7.5 | Oct 27 | Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not… Affected: 7.3; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-62254 | 7.5 | Oct 23 | The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA… Affected: 7.3; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43816 | 7.5 | Sep 25 | A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5,… Affected: before 7.4; 2023.Q3.1 through 2023.Q3.10; 2023.q4.0 through 2023.q4.10; 2024.Q1.1 before 2024.Q1.6; 7.4; 7.4; +34 more |
| CVE-2025-43801 | 7.5 | Sep 16 | Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through… Affected: before 7.3; 2023.Q3.0 before 2023.Q3.5; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43793 | 7.5 | Sep 15 | Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35,… Affected: before 7.3; 2023.q3.1 before 2023.q3.5; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43796 | 7.5 | Sep 12 | Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects… Affected: 2023.Q3.0 before 2023.Q3.5; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-3526 | 7.5 | Jun 16 | SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsupported versions does not restrict the… Affected: 7.0 through 7.2; 7.3; 7.3; 7.3; 7.3; 7.3; +31 more |
| CVE-2025-3602 | 7.5 | Jun 16 | Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does… Affected: 2023.q3.1 through 2023.q3.2; 7.2; 7.2; 7.2; 7.2; 7.2; +34 more |
| CVE-2024-25607 | 7.5 | Feb 20 | The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +34 more |
| CVE-2023-33950 | 7.5 | May 24 | Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used… Affected: 7.4; 7.4 |
| CVE-2023-33949 | 7.5 | May 24 | In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers… Affected: 7.0 through 7.2 |
| CVE-2023-33948 | 7.5 | May 24 | The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows… Affected: 7.4 |
| CVE-2022-42123 | 7.5 | Nov 15 | A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19 allows attackers to… Affected: 7.3; 7.4 |
| CVE-2022-42125 | 7.5 | Nov 15 | Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing… Affected: 7.4; 7.4 |
| CVE-2022-42124 | 7.5 | Nov 15 | ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and… Affected: 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +4 more |
| CVE-2021-38266 | 7.5 | Mar 2 | The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2021-33338 | 7.5 | Aug 4 | The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows… Affected: 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; +19 more |
| CVE-2021-33322 | 7.5 | Aug 3 | In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2021-33323 | 7.5 | Aug 3 | The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated… Affected: 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; +20 more |
| CVE-2025-3586 | 7.2 | Sep 1 | In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.q4.0 through 2023.q4.10; 2024.Q1.1 through 2024.Q1.20; 7.4; 7.4; 7.4; +13 more |
| CVE-2021-33335 | 7.2 | Aug 3 | Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with… Affected: 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; +23 more |
| CVE-2025-43748 | 6.8 | Aug 20 | Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9,… Affected: 7.0 through 7.4; 2023.Q3.1 through 2023.Q3.9; 2023.Q4.0 through 2023.Q4.9; 2024.Q1.1 before 2024.Q1.7 |
| CVE-2025-62258 | 6.5 | Oct 27 | CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and… Affected: 7.3; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-62261 | 6.5 | Oct 27 | Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older… Affected: 7.3; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-62247 | 6.5 | Oct 22 | Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16,… Affected: 2024.q1.1 before 2024.q1.20; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7 |
| CVE-2025-62250 | 6.5 | Oct 21 | Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update… Affected: before 7.3; 2023.q3.1 before 2023.q3.5; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-62251 | 6.5 | Oct 13 | Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows… Affected: through 7.4; 2023.q3.1 before 2023.q3.9; 2023.q4.0 before 2023.q4.6 |
| CVE-2025-43825 | 6.5 | Oct 3 | A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.q4.0 through 2023.q4.10; 2024.Q1.1 before 2024.Q1.13; 2024.Q2.1 through 2024.Q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.Q4.0 before 2024.Q4.6; +2 more |
| CVE-2025-43819 | 6.5 | Sep 24 | A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13,… Affected: 2024.Q1.1 before 2024.Q1.13; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.Q4.0 before 2024.Q4.4; 7.4 |
| CVE-2025-43814 | 6.5 | Sep 22 | In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 before 2023.Q4.9; 7.4; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-43798 | 6.5 | Sep 15 | Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be used multiple times… Affected: 2023.q3.1 before 2023.q3.5; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43799 | 6.5 | Sep 15 | Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update… Affected: before 7.3; 2023.q3.1 before 2023.q3.5; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43784 | 6.5 | Sep 10 | Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through… Affected: 2024.Q1.1 before 2024.Q1.13; 2024.Q2.0 before 2024.Q2.9; 7.4; 7.4; 7.4; 7.4; +34 more |