LP
Product
Liferay Portal
On CISA KEVExploited in the wild
319
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 47Medium 255Low 2
Watch
Add Liferay Portal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-3586 | 7.2 | Sep 1 | In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update… Affected: 7.4.3.27 before 7.4.3.43 |
| CVE-2020-28885 | 7.2 | Jan 28 | Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection Affected: 7.2; 7.3.5 |
| CVE-2020-28884 | 7.2 | Jan 28 | Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection Affected: 7.2; 7.3.5 |
| CVE-2021-33335 | 7.2 | Aug 3 | Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with… Affected: 7.0.3 before 7.3.5 |
| CVE-2019-11444 | 7.2 | Apr 22 | An issue was discovered in Liferay Portal CE 7.1.2 GA3 Affected: 7.1.2 |
| CVE-2025-43748 | 6.8 | Aug 20 | Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9,… Affected: 7.0.0 before 7.4.3.120; 6.2 |
| CVE-2025-62258 | 6.5 | Oct 27 | CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and… Affected: 7.4.0 before 7.4.3.108 |
| CVE-2025-62261 | 6.5 | Oct 27 | Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older… Affected: 7.0.0 before 7.4.3.100 |
| CVE-2025-62247 | 6.5 | Oct 22 | Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-62250 | 6.5 | Oct 21 | Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update… Affected: 7.0.0 before 7.4.3.132 |
| CVE-2025-62251 | 6.5 | Oct 13 | Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows… Affected: 7.3.0 before 7.4.3.119 |
| CVE-2025-43825 | 6.5 | Oct 3 | A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43819 | 6.5 | Sep 24 | A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.3.121 before 7.4.3.132 |
| CVE-2025-43814 | 6.5 | Sep 22 | In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and… Affected: 7.2.0 before 7.4.3.113 |
| CVE-2025-43799 | 6.5 | Sep 15 | Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update… Affected: before 7.4.3.112 |
| CVE-2025-43784 | 6.5 | Sep 10 | Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through… Affected: 7.4.0 before 7.4.3.125 |
| CVE-2025-43763 | 6.5 | Sep 8 | A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13,… Affected: 7.4.0 before 7.4.3.132 |
| CVE-2025-43764 | 6.5 | Aug 23 | Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay… Affected: 7.4.0 before 7.4.3.132 |
| CVE-2025-43762 | 6.5 | Aug 22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43752 | 6.5 | Aug 22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43750 | 6.5 | Aug 20 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43745 | 6.5 | Aug 19 | A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2024-26265 | 6.5 | Feb 20 | The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack… Affected: through 7.3.7; 7.4.0 before 7.4.3.16 |
| CVE-2024-25604 | 6.5 | Feb 20 | Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions… Affected: before 7.4.3.5 |
| CVE-2024-25144 | 6.5 | Feb 8 | The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and… Affected: 7.2.0 before 7.4.3.26 |
| CVE-2024-25143 | 6.5 | Feb 7 | The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older… Affected: before 7.2.0; 7.2.0 through 7.2.1; 7.3.0 before 7.3.7 |
| CVE-2022-38512 | 6.5 | Sep 22 | The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web… Affected: 7.4.3.12 through 7.4.3.36 |
| CVE-2021-38268 | 6.5 | Mar 2 | The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix… Affected: 7.0.0 before 7.3.7 |
| CVE-2020-15839 | 6.5 | Sep 22 | Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote… Affected: before 7.3.3 |
| CVE-2020-13444 | 6.5 | Jun 10 | Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information returned by the… Affected: 7.1; 7.1; 7.1; 7.1.1; 7.2; 7.3; +1 more |
| CVE-2021-29038 | 6.3 | Feb 20 | Liferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and older unsupported versions does not… Affected: through 7.2.1; 7.3.0 before 7.3.6 |
| CVE-2022-45320 | 6.3 | Feb 20 | Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become the owner of a wiki… Affected: before 7.4.3.16 |
| CVE-2021-33333 | 6.3 | Aug 3 | The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check… Affected: before 7.3.3 |
| CVE-2025-62267 | 6.1 | Oct 31 | Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through… Affected: 7.4.3.35 before 7.4.3.112 |
| CVE-2025-62264 | 6.1 | Oct 31 | Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1… Affected: 7.4.3.8 before 7.4.3.112 |
| CVE-2025-62266 | 6.1 | Oct 30 | By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through… Affected: 7.4.0 before 7.4.3.110 |
| CVE-2025-62253 | 6.1 | Oct 27 | Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through… Affected: through 7.3.7; 7.4.0 before 7.4.3.98 |
| CVE-2025-62255 | 6.1 | Oct 23 | Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP… Affected: before 7.4.3.102 |
| CVE-2025-62249 | 6.1 | Oct 21 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12,… Affected: 7.4.0 before 7.4.3.132 |
| CVE-2025-43830 | 6.1 | Oct 8 | Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4… Affected: 7.3.2 before 7.4.3.112 |
| CVE-2025-43817 | 6.1 | Sep 29 | Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through… Affected: 7.4.3.74 before 7.4.3.112 |
| CVE-2025-43818 | 6.1 | Sep 29 | Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through… Affected: 7.4.3.35 before 7.4.3.111 |
| CVE-2025-43815 | 6.1 | Sep 29 | Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, and… Affected: 7.4.3.102 before 7.4.3.111 |
| CVE-2025-43779 | 6.1 | Sep 24 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92… Affected: 7.4.0 before 7.4.3.113 |
| CVE-2025-43804 | 6.1 | Sep 16 | Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 allows remote… Affected: 7.4.3.93 before 7.4.3.112 |
| CVE-2025-43802 | 6.1 | Sep 15 | Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1… Affected: 7.4.3.51 before 7.4.3.110 |
| CVE-2025-43800 | 6.1 | Sep 15 | Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7.4 GA through update… Affected: 7.4.3.20 before 7.4.3.112 |
| CVE-2025-43791 | 6.1 | Sep 15 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and… Affected: before 7.4.3.112 |
| CVE-2025-43795 | 6.1 | Sep 12 | Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA… Affected: 7.1.0 before 7.4.3.102 |
| CVE-2025-43783 | 6.1 | Sep 10 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 before 7.4.3.129 |