DE
Product
Digital Experience Platform
264
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 35Medium 224Low 2
Watch
Add Digital Experience Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-33942 | 5.4 | May 24 | Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote… Affected: 7.4 |
| CVE-2023-33940 | 5.4 | May 24 | Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to… Affected: 7.4; 7.4; 7.4; 7.4; 7.4; 7.4; +25 more |
| CVE-2023-33939 | 5.4 | May 24 | Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3… Affected: 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; +34 more |
| CVE-2023-33937 | 5.4 | May 24 | Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 before fix pack 18, and 7.2 before fix pack… Affected: 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; +17 more |
| CVE-2022-42111 | 5.4 | Nov 15 | A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before… Affected: 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +10 more |
| CVE-2022-42112 | 5.4 | Oct 18 | A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +12 more |
| CVE-2022-28978 | 5.4 | Sep 21 | Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2022-26593 | 5.4 | Apr 19 | Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows… Affected: before 7.3; 7.3; 7.3 |
| CVE-2021-38269 | 5.4 | Mar 2 | Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 before fix pack 23, 7.2 before fix pack 13,… Affected: 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; +33 more |
| CVE-2021-38267 | 5.4 | Mar 2 | Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote… Affected: before 7.3; 7.3; 7.3 |
| CVE-2021-38265 | 5.4 | Mar 2 | Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a… Affected: through 7.3 |
| CVE-2021-33336 | 5.4 | Aug 4 | Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5… Affected: 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; +15 more |
| CVE-2021-33328 | 5.4 | Aug 3 | Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2025-62275 | 5.3 | Nov 1 | Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update… Affected: 7.4; 2023.q3.1; 2023.q3.2; 2023.q3.3; 2023.q3.4; 2023.q3.5; +16 more |
| CVE-2025-62257 | 5.3 | Oct 29 | Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through… Affected: through 7.4; 2023.q3.0; 2023.q4.0; 2024.q1.1; 2024.q1.2; 2024.q1.3; +2 more |
| CVE-2025-62256 | 5.3 | Oct 23 | Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older… Affected: 7.3; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43808 | 5.3 | Sep 19 | The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 before 2023.Q4.9; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43805 | 5.3 | Sep 16 | Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not perform an… Affected: 2023.Q3.0 before 2023.Q3.5; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43792 | 5.3 | Sep 15 | Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA… Affected: before 7.3; 2023.q3.1 before 2023.q3.5; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43789 | 5.3 | Sep 12 | JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked… Affected: 2024.Q1.1 before 2024.Q1.10; 7.4; 7.4; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-43786 | 5.3 | Sep 9 | Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through… Affected: 2024.Q1.1 before 2024.Q1.13; 2024.q2.0 through 2024.q2.13; 2024.Q3.0 before 2024.Q3.2; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-43777 | 5.3 | Sep 9 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13,… Affected: 2024.q1.1 before 2024.q1.20; 2024.q2.0 through 2024.q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.q4.0 through 2024.q4.7; 2025.Q1.0 before 2025.Q1.17; 2025.Q2.0 before 2025.Q2.10 |
| CVE-2025-43758 | 5.3 | Aug 22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 2024.Q1.1 before 2024.Q1.16; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7; 2025.Q1.0 before 2025.Q1.6; 7.4 |
| CVE-2025-43751 | 5.3 | Aug 22 | User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.q4.0 through 2023.q4.10; 2024.Q1.11 before 2024.Q1.15; 2024.q2.0 through 2024.q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.q4.0 through 2024.q4.7; +34 more |
| CVE-2025-43754 | 5.3 | Aug 21 | Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through… Affected: 2024.Q1.1 before 2024.Q1.15; 2024.q2.0 through 2024.q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.q4.0 through 2024.q4.7; 7.4; 7.4; +34 more |
| CVE-2025-43749 | 5.3 | Aug 20 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 2024.Q1.1 before 2024.Q1.15; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7; 2025.Q1.0 before 2025.Q1.2; 7.4 |
| CVE-2024-26270 | 5.3 | Feb 20 | The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in… Affected: 7.4; 7.4; 7.4; 7.4; 7.4; 7.4; +16 more |
| CVE-2024-26268 | 5.3 | Feb 20 | User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +34 more |
| CVE-2024-26267 | 5.3 | Feb 20 | In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +34 more |
| CVE-2024-25605 | 5.3 | Feb 20 | The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +22 more |
| CVE-2024-25146 | 5.3 | Feb 8 | Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with… Affected: 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +12 more |
| CVE-2022-42127 | 5.3 | Nov 15 | The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers… Affected: 7.4; 7.4 |
| CVE-2022-42128 | 5.3 | Nov 15 | The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a… Affected: 7.4 |
| CVE-2022-25146 | 5.3 | Mar 2 | The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives… Affected: through 7.4 |
| CVE-2021-29040 | 5.3 | May 16 | The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose… Affected: before 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2020-15840 | 5.3 | Sep 24 | In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with… Affected: 7.0; 7.1; 7.2 |
| CVE-2025-4655 | 5.0 | Aug 9 | SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through… Affected: 2024.Q1.1 before 2024.Q1.16; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7; 2025.Q1.0 before 2025.Q1.6; 7.4; +34 more |
| CVE-2021-33325 | 4.9 | Aug 3 | The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2025-62248 | 4.8 | Oct 22 | A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0… Affected: 2024.q1.1 before 2024.q1.20; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7 |
| CVE-2025-43794 | 4.8 | Sep 15 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4,… Affected: before 7.3; 2023.q3.1 before 2023.q3.5; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2023-37940 | 4.8 | Dec 17 | Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through… Affected: 7.0 before 7.3; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2022-42131 | 4.8 | Nov 15 | Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers Affected: 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; +34 more |
| CVE-2021-33339 | 4.8 | Aug 4 | Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject… Affected: 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +3 more |
| CVE-2023-47798 | 4.6 | Feb 8 | Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2 |
| CVE-2025-62262 | 4.4 | Oct 27 | Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q3.1… Affected: 7.3; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-62252 | 4.3 | Oct 13 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5,… Affected: through 7.4; 2023.Q3.1 through 2023.Q3.10; 2023.q4.0 before 2023.q4.6 |
| CVE-2025-62241 | 4.3 | Oct 13 | Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to from one virtual… Affected: 2023.q4.1; 2023.q4.2; 2023.q4.3; 2023.q4.4; 2023.q4.5 |
| CVE-2025-62242 | 4.3 | Oct 13 | Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1… Affected: 7.4; 2023.q3.1; 2023.q3.2; 2023.q3.3; 2023.q3.4; 2023.q3.5; +10 more |
| CVE-2025-62244 | 4.3 | Oct 13 | Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through… Affected: 2023.q3.1 before 2023.q3.9; 2023.q4.0 before 2023.q4.6; 7.3; 7.4 |
| CVE-2025-62245 | 4.3 | Oct 10 | Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.q4.0 before 2023.q4.6; 7.4 |