LP
Product
Liferay Portal
On CISA KEVExploited in the wild
319
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 47Medium 255Low 2
Watch
Add Liferay Portal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-29046 | 6.1 | May 17 | Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers… Affected: 7.3.5 |
| CVE-2021-29045 | 6.1 | May 17 | Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1… Affected: 7.3.2 through 7.3.5 |
| CVE-2021-29039 | 6.1 | May 16 | Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or… Affected: 7.3.4 |
| CVE-2020-25476 | 6.1 | Jan 7 | Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar Affected: 7.1.3; 7.2.1 |
| CVE-2019-16147 | 6.1 | Sep 9 | Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib Affected: before 7.2.0; 7.2.0; 7.2.0; 7.2.0; 7.2.0; 7.2.0; +3 more |
| CVE-2017-1000425 | 6.1 | Jan 2 | Cross-site scripting (XSS) vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers to inject arbitrary web script or HTML… Affected: before 7.0.3_ga4 |
| CVE-2017-17868 | 6.1 | Dec 23 | In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter (p_r_p) value, as demonstrated by p_r_p_564233524_tag Affected: 6.1.0 |
| CVE-2016-10404 | 6.1 | Aug 7 | XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted redirect field to… Affected: through 7.0 |
| CVE-2017-12646 | 6.1 | Aug 7 | XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address Affected: through 7.0 |
| CVE-2017-12645 | 6.1 | Aug 7 | XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId Affected: through 7.0 |
| CVE-2017-12647 | 6.1 | Aug 7 | XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title Affected: through 7.0 |
| CVE-2017-12649 | 6.1 | Aug 7 | XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display Affected: through 7.0 |
| CVE-2017-12648 | 6.1 | Aug 7 | XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL Affected: through 7.0 |
| CVE-2016-3670 | 6.1 | Jun 13 | Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or… Affected: through 6.2 |
| CVE-2022-42132 | 5.9 | Nov 15 | The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before… Affected: 7.0.0 before 7.4.3.5 |
| CVE-2021-29043 | 5.9 | May 17 | The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1… Affected: 7.0.0 through 7.3.5 |
| CVE-2025-62276 | 5.5 | Oct 31 | The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10,… Affected: 7.4.0 before 7.4.3.112 |
| CVE-2025-62265 | 5.4 | Oct 30 | Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through… Affected: 7.2.0 before 7.4.3.112 |
| CVE-2025-62259 | 5.4 | Oct 27 | Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older… Affected: before 7.4.3.110 |
| CVE-2025-62263 | 5.4 | Oct 27 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 service… Affected: 7.3.7 before 7.4.3.104 |
| CVE-2025-62246 | 5.4 | Oct 13 | Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5,… Affected: 7.1.0 before 7.4.3.112 |
| CVE-2025-62243 | 5.4 | Oct 13 | Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through… Affected: 7.4.1 before 7.4.3.113 |
| CVE-2025-62237 | 5.4 | Oct 10 | Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1… Affected: 7.4.3.8 before 7.4.3.112 |
| CVE-2025-62238 | 5.4 | Oct 10 | Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through… Affected: 7.4.3.21 before 7.4.3.112 |
| CVE-2025-62239 | 5.4 | Oct 10 | Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through… Affected: 7.4.3.21 before 7.4.3.112 |
| CVE-2025-62240 | 5.4 | Oct 9 | Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1… Affected: 7.4.3.35 before 7.4.3.112 |
| CVE-2025-43771 | 5.4 | Oct 8 | Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5 and… Affected: 7.4.3.102 before 7.4.3.112 |
| CVE-2025-43829 | 5.4 | Oct 8 | Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.18 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5,… Affected: 7.4.3.18 before 7.4.3.112 |
| CVE-2025-43821 | 5.4 | Oct 8 | Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5,… Affected: 7.4.0 before 7.4.3.112 |
| CVE-2025-43822 | 5.4 | Oct 7 | Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8,… Affected: 7.4.3.15 before 7.4.3.112 |
| CVE-2025-43823 | 5.4 | Oct 7 | Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before… Affected: 7.4.0 before 7.4.3.112 |
| CVE-2025-43824 | 5.4 | Oct 6 | The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA… Affected: before 7.4.3.112 |
| CVE-2025-43826 | 5.4 | Sep 30 | Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0… Affected: 7.2.0 before 7.4.3.113 |
| CVE-2025-43812 | 5.4 | Sep 29 | Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through… Affected: 7.4.3.4 before 7.4.3.112 |
| CVE-2025-43811 | 5.4 | Sep 29 | Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4,… Affected: 7.4.3.50 before 7.4.3.112 |
| CVE-2025-43820 | 5.4 | Sep 29 | Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0… Affected: 7.4.3.35 before 7.4.3.111 |
| CVE-2025-43807 | 5.4 | Sep 22 | Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1… Affected: 7.4.0 before 7.4.3.113 |
| CVE-2025-43797 | 5.4 | Sep 15 | In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported… Affected: before 7.4.3.112 |
| CVE-2025-43787 | 5.4 | Sep 12 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43775 | 5.4 | Sep 9 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1… Affected: 7.4.0 before 7.4.3.129 |
| CVE-2025-43776 | 5.4 | Sep 9 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43760 | 5.4 | Aug 22 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43753 | 5.4 | Aug 21 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7, 2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.3.32 through 7.4.3.132 |
| CVE-2025-43755 | 5.4 | Aug 21 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.13, 2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43756 | 5.4 | Aug 21 | <!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}-->A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP… Affected: 7.4.3.132 |
| CVE-2025-43757 | 5.4 | Aug 20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43746 | 5.4 | Aug 20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43741 | 5.4 | Aug 20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43744 | 5.4 | Aug 19 | A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43737 | 5.4 | Aug 19 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote… Affected: 7.4.0 through 7.4.3.132 |