LP
Product
Liferay Portal
On CISA KEVExploited in the wild
319
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 47Medium 255Low 2
Watch
Add Liferay Portal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-43769 | 6.1 | Aug 23 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1… Affected: 7.4.0 before 7.4.3.132 |
| CVE-2025-43770 | 6.1 | Aug 23 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.0 before 7.4.3.132 |
| CVE-2025-43761 | 6.1 | Aug 22 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.0 before 7.4.3.132 |
| CVE-2025-43742 | 6.1 | Aug 20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43735 | 6.1 | Aug 12 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.0 through 7.4.3.131 |
| CVE-2025-4576 | 6.1 | Aug 8 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.0 through 7.4.3.133 |
| CVE-2025-4604 | 6.1 | Aug 4 | The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.3.80 through 7.4.3.132 |
| CVE-2025-4599 | 6.1 | Aug 4 | The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through… Affected: 7.4.3.61 before 7.4.3.132 |
| CVE-2025-4388 | 6.1 | May 6 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.0 before 7.4.3.132 |
| CVE-2025-2536 | 6.1 | Mar 19 | Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12,… Affected: 7.4.3.82 through 7.4.3.128 |
| CVE-2024-11993 | 6.1 | Dec 17 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary… Affected: 7.1.0 before 7.4.3.39 |
| CVE-2024-8980 | 6.1 | Oct 22 | The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix… Affected: 7.0.0 before 7.0.6; 7.1.0 before 7.1.3; 7.2.0 through 7.2.1; 7.3.0 through 7.3.7; 7.4.0 before 7.4.3.102 |
| CVE-2023-40191 | 6.1 | Feb 21 | Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and… Affected: 7.4.3.44 before 7.4.3.98 |
| CVE-2023-42498 | 6.1 | Feb 21 | Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4… Affected: 7.4.3.8 before 7.4.3.98 |
| CVE-2024-26269 | 6.1 | Feb 21 | Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update… Affected: 7.2.0 before 7.4.3.38 |
| CVE-2023-42496 | 6.1 | Feb 21 | Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA… Affected: 7.3.3 before 7.4.3.98 |
| CVE-2024-25147 | 6.1 | Feb 21 | Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3,… Affected: before 7.4.2 |
| CVE-2024-25609 | 6.1 | Feb 20 | HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through… Affected: before 7.4.3.13 |
| CVE-2024-25608 | 6.1 | Feb 20 | HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack… Affected: before 7.4.3.19 |
| CVE-2023-5190 | 6.1 | Feb 20 | Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45… Affected: 7.4.3.45 before 7.4.3.102 |
| CVE-2023-47797 | 6.1 | Nov 17 | Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script… Affected: 7.4.3.94 through 7.4.3.95 |
| CVE-2023-44311 | 6.1 | Oct 17 | Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through… Affected: 7.4.3.41 before 7.4.3.90 |
| CVE-2023-42497 | 6.1 | Oct 17 | Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows… Affected: 7.4.3.4 before 7.4.3.86 |
| CVE-2023-35029 | 6.1 | Jun 15 | Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers… Affected: 7.4.3.70 before 7.4.3.77 |
| CVE-2023-3193 | 6.1 | Jun 15 | Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows… Affected: 7.4.3.70 before 7.4.3.74 |
| CVE-2023-33944 | 6.1 | May 24 | Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote… Affected: 7.3.4 through 7.3.7 |
| CVE-2023-33941 | 6.1 | May 24 | Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and… Affected: 7.4.3.41 through 7.4.3.52 |
| CVE-2023-33938 | 6.1 | May 24 | Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows… Affected: 7.3.0 through 7.3.7; 7.4.0 |
| CVE-2022-42118 | 6.1 | Nov 15 | A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and… Affected: 7.1.0 through 7.4.2 |
| CVE-2022-42110 | 6.1 | Nov 14 | A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and… Affected: 7.1.0 through 7.4.2 |
| CVE-2022-42117 | 6.1 | Oct 18 | A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17… Affected: 7.3.2 through 7.4.3.16 |
| CVE-2022-42116 | 6.1 | Oct 18 | A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6,… Affected: 7.3.2 before 7.4.3.15 |
| CVE-2022-42113 | 6.1 | Oct 18 | A Cross-site scripting (XSS) vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote… Affected: 7.4.3.30 before 7.4.3.37 |
| CVE-2022-28980 | 6.1 | Sep 22 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters… Affected: before 7.4.3.5 |
| CVE-2022-28977 | 6.1 | Sep 22 | HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before… Affected: 7.3.1 before 7.4.3.4 |
| CVE-2022-28982 | 6.1 | Sep 21 | A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or… Affected: 7.3.3 before 7.4.3.4 |
| CVE-2022-28979 | 6.1 | Sep 21 | Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting… Affected: 7.1.0 before 7.4.3.4 |
| CVE-2022-26596 | 6.1 | Apr 25 | Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94,… Affected: 7.1.0 through 7.3.3 |
| CVE-2022-26597 | 6.1 | Apr 25 | Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows… Affected: 7.3.0 through 7.4.0 |
| CVE-2022-26594 | 6.1 | Apr 15 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web… Affected: 7.3.5 before 7.3.7; 7.4.0 |
| CVE-2021-38263 | 6.1 | Mar 2 | Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20… Affected: through 7.3.2 |
| CVE-2021-38264 | 6.1 | Mar 2 | Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the… Affected: 7.4.0; 7.4.1 |
| CVE-2021-35463 | 6.1 | Aug 4 | Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management… Affected: 7.4.0 |
| CVE-2021-33337 | 6.1 | Aug 4 | Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2… Affected: 7.3.0 through 7.3.4 |
| CVE-2021-33332 | 6.1 | Aug 3 | Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack… Affected: 7.1.0 before 7.3.3 |
| CVE-2021-33331 | 6.1 | Aug 3 | Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19 and 7.2 before fix… Affected: 7.0.0 before 7.3.2 |
| CVE-2021-33326 | 6.1 | Aug 3 | Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2… Affected: before 7.3.5 |
| CVE-2021-29048 | 6.1 | May 17 | Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix… Affected: 7.3.4; 7.3.5 |
| CVE-2021-29051 | 6.1 | May 17 | Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix… Affected: 7.2.0 through 7.3.5 |
| CVE-2021-29044 | 6.1 | May 17 | Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack… Affected: 7.0.0 through 7.3.5 |