LP
Product
Liferay Portal
On CISA KEVExploited in the wild
319
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 47Medium 255Low 2
Watch
Add Liferay Portal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-42129 | 4.3 | Nov 15 | An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4… Affected: 7.3.2 before 7.4.3.5 |
| CVE-2022-42126 | 4.3 | Nov 15 | The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset… Affected: 7.3.5 before 7.4.3.29 |
| CVE-2022-39975 | 4.3 | Sep 21 | The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the… Affected: 7.3.3 before 7.4.3.35 |
| CVE-2022-26595 | 4.3 | Apr 19 | Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which… Affected: 7.3.7; 7.4.0; 7.4.1 |
| CVE-2021-33334 | 4.3 | Aug 3 | The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly… Affected: 7.0.0 before 7.3.3 |
| CVE-2021-33330 | 4.3 | Aug 3 | Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only… Affected: 7.2.0 before 7.3.3 |
| CVE-2021-33327 | 4.3 | Aug 3 | The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly… Affected: 7.2.0 before 7.3.4 |
| CVE-2021-33324 | 4.3 | Aug 3 | The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which… Affected: 7.1.0 before 7.3.2 |
| CVE-2021-33320 | 4.3 | Aug 3 | The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit the rate at which… Affected: before 7.3.1 |
| CVE-2021-29052 | 4.3 | May 17 | The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in… Affected: 7.3.0 through 7.3.5 |
| CVE-2025-43759 | 2.7 | Aug 22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43732 | 2.7 | Aug 18 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2014-8349 | – | Nov 24 | Cross-site scripting (XSS) vulnerability in Liferay Portal Enterprise Edition (EE) 6.2 SP8 and earlier allows remote authenticated users to inject arbitrary web script or HTML via… Affected: through 6.2 |
| CVE-2014-2963 | – | Jul 10 | Multiple cross-site scripting (XSS) vulnerabilities in group/control_panel/manage in Liferay Portal 6.1.2 CE GA3, 6.1.X EE, and 6.2.X EE allow remote attackers to inject arbitrary… Affected: 6.1.2_ce_ga3; 6.1.x_ee; 6.2.x_ee |
| CVE-2011-1570 | – | May 7 | Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject… Affected: 6.0.0 through 6.0.5 |
| CVE-2011-1502 | – | May 7 | Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in… Affected: 6.0.0 through 6.0.5 |
| CVE-2011-1503 | – | May 7 | The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to… Affected: 5.1.0 through 5.1.2; 5.2.0 through 5.2.3; 6.0.0 through 6.0.5 |
| CVE-2011-1571 | – | May 7 | Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to… Affected: 5.1.0 through 5.1.2; 6.0.0 through 6.0.5 |
| CVE-2009-3742 | – | Jan 7 | Cross-site scripting (XSS) vulnerability in Liferay Portal before 5.3.0 allows remote attackers to inject arbitrary web script or HTML via the p_p_id parameter Affected: through 5.2.3 |