LP
Product
Liferay Portal
On CISA KEVExploited in the wild
319
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 47Medium 255Low 2
Watch
Add Liferay Portal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-43805 | 5.3 | Sep 16 | Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not perform an… Affected: 7.3.0 before 7.4.3.112 |
| CVE-2025-43792 | 5.3 | Sep 15 | Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA… Affected: before 7.4.3.106 |
| CVE-2025-43789 | 5.3 | Sep 12 | JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked… Affected: 7.4.0 before 7.4.3.120 |
| CVE-2025-43786 | 5.3 | Sep 9 | Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through… Affected: 7.4.0 before 7.4.3.129 |
| CVE-2025-43777 | 5.3 | Sep 9 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43758 | 5.3 | Aug 22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43751 | 5.3 | Aug 22 | User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43754 | 5.3 | Aug 21 | Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43749 | 5.3 | Aug 20 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2024-26270 | 5.3 | Feb 20 | The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in… Affected: 7.4.3.76 before 7.4.3.100 |
| CVE-2024-26268 | 5.3 | Feb 20 | User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix… Affected: through 7.3.7; 7.4.0 before 7.4.3.27 |
| CVE-2024-26267 | 5.3 | Feb 20 | In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported… Affected: through 7.3.7; 7.4.0 before 7.4.3.26 |
| CVE-2024-25605 | 5.3 | Feb 20 | The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older… Affected: before 7.4.3.5 |
| CVE-2024-25146 | 5.3 | Feb 8 | Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with… Affected: 7.2.0 through 7.4.1 |
| CVE-2022-42127 | 5.3 | Nov 15 | The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers… Affected: 7.4.3.5 before 7.4.3.37 |
| CVE-2022-42128 | 5.3 | Nov 15 | The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a… Affected: 7.4.1 before 7.4.3.5 |
| CVE-2022-41414 | 5.3 | Oct 7 | An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages Affected: 7.0.0 through 7.4.2 |
| CVE-2022-25146 | 5.3 | Mar 2 | The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives… Affected: 7.4.3.4 before 7.4.3.9 |
| CVE-2021-29040 | 5.3 | May 16 | The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose… Affected: through 7.3.4 |
| CVE-2020-15840 | 5.3 | Sep 24 | In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with… Affected: before 7.3.1; 6.2 |
| CVE-2025-4655 | 5.0 | Aug 9 | SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2021-33325 | 4.9 | Aug 3 | The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text… Affected: before 7.3.3 |
| CVE-2025-62248 | 4.8 | Oct 22 | A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43794 | 4.8 | Sep 15 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4,… Affected: before 7.4.3.112 |
| CVE-2023-37940 | 4.8 | Dec 17 | Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through… Affected: 7.0.0 before 7.4.3.88 |
| CVE-2022-42131 | 4.8 | Nov 15 | Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers Affected: 7.1.0 before 7.4.3.4 |
| CVE-2021-33339 | 4.8 | Aug 4 | Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject… Affected: 7.2.1 before 7.3.5 |
| CVE-2019-6588 | 4.7 | Jun 3 | In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call… Affected: through 6.0.6; 6.1.0; 6.1.0; 6.1.0; 6.1.0; 6.1.0; +34 more |
| CVE-2023-47798 | 4.6 | Feb 8 | Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate… Affected: 7.2.0 before 7.3.0 |
| CVE-2025-62262 | 4.4 | Oct 27 | Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q3.1… Affected: 7.0.0 before 7.4.3.98 |
| CVE-2025-62252 | 4.3 | Oct 13 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5,… Affected: 7.1.0 before 7.4.3.112 |
| CVE-2025-62242 | 4.3 | Oct 13 | Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1… Affected: 7.4.1 before 7.4.3.112 |
| CVE-2025-62244 | 4.3 | Oct 13 | Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through… Affected: 7.3.1 before 7.4.3.112 |
| CVE-2025-62245 | 4.3 | Oct 10 | Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA… Affected: 7.4.1 before 7.4.3.113 |
| CVE-2025-43827 | 4.3 | Sep 30 | Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1… Affected: 7.2.0 before 7.4.3.118 |
| CVE-2025-43810 | 4.3 | Sep 22 | Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1… Affected: 7.2.0 before 7.4.3.113 |
| CVE-2025-43806 | 4.3 | Sep 22 | Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 does not properly… Affected: 7.2.0 before 7.4.3.113 |
| CVE-2025-43809 | 4.3 | Sep 19 | Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay… Affected: 7.4.0 before 7.4.3.112 |
| CVE-2025-43803 | 4.3 | Sep 19 | Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP… Affected: 7.4.0 before 7.4.3.120 |
| CVE-2025-43788 | 4.3 | Sep 12 | The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user… Affected: 7.4.3.81 through 7.4.3.85; 7.4.3.94 before 7.4.3.125 |
| CVE-2025-43782 | 4.3 | Sep 11 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7, 2024.Q1.1 through 2024.Q1.12, and 7.4… Affected: 7.4.0 before 7.4.3.125 |
| CVE-2025-43743 | 4.3 | Aug 19 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43739 | 4.3 | Aug 19 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.3.94 through 7.4.3.132 |
| CVE-2025-43736 | 4.3 | Aug 12 | A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.3.0 through 7.4.3.132 |
| CVE-2025-2565 | 4.3 | Mar 20 | The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through… Affected: 7.4.0 through 7.4.3.128 |
| CVE-2024-25150 | 4.3 | Feb 20 | Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before… Affected: before 7.4.3.4 |
| CVE-2023-3426 | 4.3 | Aug 2 | The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated… Affected: 7.4.3.81 through 7.4.3.85 |
| CVE-2023-33947 | 4.3 | May 24 | The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows… Affected: 7.4.3.4 through 7.4.3.60 |
| CVE-2023-33946 | 4.3 | May 24 | The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows… Affected: 7.4.3.4 through 7.4.3.48 |
| CVE-2022-42130 | 4.3 | Nov 15 | The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not… Affected: 7.1.0 before 7.4.3.5 |