LP
Product
Liferay Portal
On CISA KEVExploited in the wild
319
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 47Medium 255Low 2
Watch
Add Liferay Portal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-43757 | 5.4 | Aug 20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43746 | 5.4 | Aug 20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43741 | 5.4 | Aug 20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43744 | 5.4 | Aug 19 | A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43737 | 5.4 | Aug 19 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43738 | 5.4 | Aug 19 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43740 | 5.4 | Aug 19 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0… Affected: 7.4.3.120 through 7.4.3.132 |
| CVE-2025-43731 | 5.4 | Aug 18 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43733 | 5.4 | Aug 18 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated attacker to inject… Affected: 7.4.3.132 |
| CVE-2025-43734 | 5.4 | Aug 12 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-3760 | 5.4 | Apr 17 | A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through… Affected: 7.2.0 through 7.4.3.129 |
| CVE-2023-47795 | 5.4 | Feb 21 | Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4… Affected: 7.4.3.18 before 7.4.3.102 |
| CVE-2024-25151 | 5.4 | Feb 21 | The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported… Affected: 7.2.0 before 7.4.3.4 |
| CVE-2024-26266 | 5.4 | Feb 21 | Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before update 10, 7.3… Affected: 7.2.0 before 7.4.3.14 |
| CVE-2024-25603 | 5.4 | Feb 21 | Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay… Affected: 7.2.0 before 7.4.3.5 |
| CVE-2024-25152 | 5.4 | Feb 21 | Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service… Affected: before 7.4.3.4 |
| CVE-2024-25601 | 5.4 | Feb 21 | Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay… Affected: before 7.4.3.4 |
| CVE-2024-25602 | 5.4 | Feb 21 | Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3… Affected: before 7.4.3.4 |
| CVE-2024-25610 | 5.4 | Feb 20 | In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported… Affected: before 7.4.3.13 |
| CVE-2024-25149 | 5.4 | Feb 20 | Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not… Affected: before 7.4.2 |
| CVE-2024-25145 | 5.4 | Feb 7 | Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and… Affected: through 7.2.1; 7.3.0 through 7.3.7; 7.4.0 before 7.4.3.12 |
| CVE-2023-42627 | 5.4 | Oct 17 | Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and earlier, and 7.4… Affected: 7.3.5 before 7.4.3.92 |
| CVE-2023-42628 | 5.4 | Oct 17 | Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and… Affected: 7.1.0 before 7.4.3.88 |
| CVE-2023-44310 | 5.4 | Oct 17 | Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79… Affected: 7.3.6 before 7.4.3.49 |
| CVE-2023-44309 | 5.4 | Oct 17 | Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay DXP 7.4 before update 54 allow remote… Affected: 7.4.2 before 7.4.3.53 |
| CVE-2023-42629 | 5.4 | Oct 17 | Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote… Affected: 7.4.2 before 7.4.3.88 |
| CVE-2023-33943 | 5.4 | May 24 | Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to… Affected: 7.4.3.21 through 7.4.3.62 |
| CVE-2023-33942 | 5.4 | May 24 | Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote… Affected: 7.4.3.50 |
| CVE-2023-33940 | 5.4 | May 24 | Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to… Affected: 7.4.0 through 7.4.3.30 |
| CVE-2023-33939 | 5.4 | May 24 | Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3… Affected: 7.1.0 through 7.4.3.12 |
| CVE-2023-33937 | 5.4 | May 24 | Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 before fix pack 18, and 7.2 before fix pack… Affected: 7.1.0 through 7.3.0 |
| CVE-2022-42111 | 5.4 | Nov 15 | A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before… Affected: 7.2.1 through 7.4.2 |
| CVE-2022-42119 | 5.4 | Nov 15 | Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module Affected: 7.3.5 through 7.4.2 |
| CVE-2022-38901 | 5.4 | Oct 19 | A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers… Affected: 7.3.5 through 7.4.3.28 |
| CVE-2022-42114 | 5.4 | Oct 18 | A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and Liferay DXP 7.4 before update 37 allows… Affected: 7.4.0 before 7.4.3.37 |
| CVE-2022-42112 | 5.4 | Oct 18 | A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before… Affected: 7.2.0 before 7.4.3.25 |
| CVE-2022-42115 | 5.4 | Oct 18 | Cross-site scripting (XSS) vulnerability in the Object module's edit object details page in Liferay Portal 7.4.3.4 through 7.4.3.36 allows remote attackers to inject arbitrary web… Affected: 7.4.3.4 before 7.4.3.37 |
| CVE-2022-38902 | 5.4 | Oct 13 | A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject… Affected: 7.3.0 through 7.4.0 |
| CVE-2022-28978 | 5.4 | Sep 21 | Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack… Affected: 7.0.1 before 7.4.2 |
| CVE-2022-26593 | 5.4 | Apr 19 | Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows… Affected: 7.3.3 before 7.3.7; 7.4.0 |
| CVE-2021-38269 | 5.4 | Mar 2 | Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 before fix pack 23, 7.2 before fix pack 13,… Affected: 7.1.0 through 7.3.6; 7.4.0 |
| CVE-2021-38267 | 5.4 | Mar 2 | Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote… Affected: 7.3.2 through 7.3.6 |
| CVE-2021-38265 | 5.4 | Mar 2 | Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a… Affected: 7.3.4 through 7.3.6 |
| CVE-2021-33336 | 5.4 | Aug 4 | Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5… Affected: 7.3.0 before 7.3.4 |
| CVE-2021-33328 | 5.4 | Aug 3 | Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix… Affected: 7.0.0 before 7.3.5 |
| CVE-2020-7934 | 5.4 | Jan 28 | In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue Affected: 7.1.0 through 7.2.1 |
| CVE-2025-62275 | 5.3 | Nov 1 | Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update… Affected: 7.4.0 before 7.4.3.112 |
| CVE-2025-62257 | 5.3 | Oct 29 | Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through… Affected: 7.4.0 before 7.4.3.120 |
| CVE-2025-62256 | 5.3 | Oct 23 | Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older… Affected: 7.4.0 before 7.4.3.110 |
| CVE-2025-43808 | 5.3 | Sep 19 | The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3… Affected: 7.4.0 before 7.4.3.113 |