DE
Product
Digital Experience Platform
264
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 35Medium 224Low 2
Watch
Add Digital Experience Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-43748 | 6.8 | Aug 20 | Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9,… Affected: 7.0 through 7.4; 2023.Q3.1 through 2023.Q3.9; 2023.Q4.0 through 2023.Q4.9; 2024.Q1.1 before 2024.Q1.7 |
| CVE-2025-62258 | 6.5 | Oct 27 | CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and… Affected: 7.3; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-62261 | 6.5 | Oct 27 | Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older… Affected: 7.3; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-62247 | 6.5 | Oct 22 | Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16,… Affected: 2024.q1.1 before 2024.q1.20; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7 |
| CVE-2025-62250 | 6.5 | Oct 21 | Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update… Affected: before 7.3; 2023.q3.1 before 2023.q3.5; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-62251 | 6.5 | Oct 13 | Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows… Affected: through 7.4; 2023.q3.1 before 2023.q3.9; 2023.q4.0 before 2023.q4.6 |
| CVE-2025-43825 | 6.5 | Oct 3 | A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.q4.0 through 2023.q4.10; 2024.Q1.1 before 2024.Q1.13; 2024.Q2.1 through 2024.Q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.Q4.0 before 2024.Q4.6; +2 more |
| CVE-2025-43819 | 6.5 | Sep 24 | A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13,… Affected: 2024.Q1.1 before 2024.Q1.13; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.Q4.0 before 2024.Q4.4; 7.4 |
| CVE-2025-43814 | 6.5 | Sep 22 | In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 before 2023.Q4.9; 7.4; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-43798 | 6.5 | Sep 15 | Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be used multiple times… Affected: 2023.q3.1 before 2023.q3.5; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43799 | 6.5 | Sep 15 | Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update… Affected: before 7.3; 2023.q3.1 before 2023.q3.5; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43784 | 6.5 | Sep 10 | Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through… Affected: 2024.Q1.1 before 2024.Q1.13; 2024.Q2.0 before 2024.Q2.9; 7.4; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-43763 | 6.5 | Sep 8 | A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13,… Affected: 2024.q1.1 before 2024.q1.21; 2024.q2.0 through 2024.q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.q4.0 through 2024.q4.7 |
| CVE-2025-43764 | 6.5 | Aug 23 | Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay… Affected: 2024.Q1.1 through 2024.Q1.20; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.Q4.0 before 2024.Q4.2; 7.4; 7.4; +34 more |
| CVE-2025-43762 | 6.5 | Aug 22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 2024.Q1.1 before 2024.Q1.15; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7; 2025.Q1.0 before 2025.Q1.2; 7.4; +34 more |
| CVE-2025-43752 | 6.5 | Aug 22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 2024.Q1.1 before 2024.Q1.16; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.Q4.0 through 2024.Q4.10; 2025.Q1.0 before 2025.Q1.5; 7.4 |
| CVE-2025-43747 | 6.5 | Aug 21 | A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.domain.allowed,… Affected: 2025.Q2.0 before 2025.Q2.4 |
| CVE-2025-43750 | 6.5 | Aug 20 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 2024.Q1.1 before 2024.Q1.15; 2024.q2.0 through 2024.q2.12; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7; 2025.Q1.0 before 2025.Q1.2; 7.4; +34 more |
| CVE-2025-43745 | 6.5 | Aug 19 | A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1… Affected: 2024.q1.1 before 2024.q1.20; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7; 2025.Q1.0 before 2025.Q1.16; 2025.Q2.0 before 2025.Q2.8; +34 more |
| CVE-2024-26265 | 6.5 | Feb 20 | The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +34 more |
| CVE-2024-25604 | 6.5 | Feb 20 | Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +21 more |
| CVE-2024-25144 | 6.5 | Feb 8 | The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and… Affected: 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +13 more |
| CVE-2024-25143 | 6.5 | Feb 7 | The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +10 more |
| CVE-2021-38268 | 6.5 | Mar 2 | The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix… Affected: before 7.2.1; 7.2; 7.2; 7.2; 7.2; 7.2; +6 more |
| CVE-2020-15839 | 6.5 | Sep 22 | Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote… Affected: 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; +19 more |
| CVE-2021-29038 | 6.3 | Feb 20 | Liferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and older unsupported versions does not… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +13 more |
| CVE-2022-45320 | 6.3 | Feb 20 | Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become the owner of a wiki… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +34 more |
| CVE-2021-33333 | 6.3 | Aug 3 | The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2025-62267 | 6.1 | Oct 31 | Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through… Affected: 7.4; 7.4; 7.4; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-62264 | 6.1 | Oct 31 | Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1… Affected: 7.4; 7.4; 7.4; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-62266 | 6.1 | Oct 30 | By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through… Affected: 7.3; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-62253 | 6.1 | Oct 27 | Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through… Affected: before 7.3; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-62255 | 6.1 | Oct 23 | Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP… Affected: before 7.3; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-62249 | 6.1 | Oct 21 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12,… Affected: 2023.q4.0 through 2023.q4.10; 2024.q1.1 before 2024.q1.21; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2025.q1.0 before 2025.q1.18; 2025.q2.0 through 2025.q2.12; +1 more |
| CVE-2025-43830 | 6.1 | Oct 8 | Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4… Affected: 2023.q3.1 before 2023.q3.9; 2023.q4.0 before 2023.q4.6; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43817 | 6.1 | Sep 29 | Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through… Affected: 2023.q3.1 before 2023.q3.9; 2023.Q4.0 before 2023.Q4.7; 7.4; 7.4; 7.4; 7.4; +15 more |
| CVE-2025-43818 | 6.1 | Sep 29 | Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through… Affected: 2023.Q3.1 before 2023.Q3.7; 2023.Q4.0 before 2023.Q4.5; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43815 | 6.1 | Sep 29 | Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, and… Affected: 2023.q4.0 before 2023.q4.3; 2023.q3.5 |
| CVE-2025-43779 | 6.1 | Sep 24 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92… Affected: 2024.Q1.1 before 2024.Q1.19; 7.4 |
| CVE-2025-43804 | 6.1 | Sep 16 | Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 allows remote… Affected: 2023.q3.0; 2023.q3.1; 2023.q3.2; 2023.q3.3; 2023.q3.4; 2023.q4.0; +1 more |
| CVE-2025-43802 | 6.1 | Sep 15 | Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1… Affected: 2023.q3.1 before 2023.q3.5; 7.3; 7.3; 7.3; 7.4; 7.4; +34 more |
| CVE-2025-43800 | 6.1 | Sep 15 | Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7.4 GA through update… Affected: 2023.q3.1 before 2023.q3.5; 7.4; 2023.q4.0 |
| CVE-2025-43791 | 6.1 | Sep 15 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and… Affected: 2023.q3.1 before 2023.q3.5; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43795 | 6.1 | Sep 12 | Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA… Affected: before 7.3; 2023.Q3.0 before 2023.Q3.5; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43783 | 6.1 | Sep 10 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13,… Affected: 2024.Q1.1 before 2024.Q1.13; 2024.q2.0 through 2024.q2.13; 2024.Q3.0 before 2024.Q3.2; 7.4; 7.4; 7.4; +17 more |
| CVE-2025-43785 | 6.1 | Sep 10 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4… Affected: 2024.Q1.1 before 2024.Q1.13; 2024.Q2.0 through 2024.Q2.9; 7.4; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-43781 | 6.1 | Sep 9 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13 and… Affected: 2024.Q1.1 before 2024.Q1.13; 2024.q2.0 through 2024.q2.13; 2024.Q3.0 before 2024.Q3.9 |
| CVE-2025-43778 | 6.1 | Sep 9 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0… Affected: 2024.q1.1 before 2024.q1.21; 2024.q2.0 through 2024.q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.q4.0 through 2024.q4.7; 2025.Q1.0 before 2025.Q1.17; 2025.Q2.0 before 2025.Q2.12 |
| CVE-2025-43765 | 6.1 | Aug 23 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 2024.Q1.1 before 2024.Q1.14; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-43767 | 6.1 | Aug 23 | Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0… Affected: 2024.Q1.1 before 2024.Q1.13; 2024.q2.0 through 2024.q2.13; 2024.Q3.1 before 2024.Q3.10; 7.4; 7.4; 7.4; +4 more |