PO
Product
Portal
210
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 27Medium 174Low 3
Watch
Add Portal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-43757 | 5.4 | Aug 20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43746 | 5.4 | Aug 20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43741 | 5.4 | Aug 20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43744 | 5.4 | Aug 19 | A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43737 | 5.4 | Aug 19 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote… Affected: 7.4.3.132 |
| CVE-2025-43738 | 5.4 | Aug 19 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43740 | 5.4 | Aug 19 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0… Affected: 7.4.3.120 through 7.4.3.132 |
| CVE-2025-43731 | 5.4 | Aug 18 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43733 | 5.4 | Aug 18 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated attacker to inject… Affected: 7.4.3.132 |
| CVE-2025-43734 | 5.4 | Aug 12 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.3.0 through 7.4.3.132 |
| CVE-2025-3760 | 5.4 | Apr 17 | A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through… Affected: 7.2.0 through 7.4.3.129 |
| CVE-2023-47795 | 5.4 | Feb 21 | Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4… Affected: 7.4.3.18 through 7.4.3.101 |
| CVE-2024-25151 | 5.4 | Feb 21 | The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported… Affected: 7.2.0 through 7.4.2 |
| CVE-2024-26266 | 5.4 | Feb 21 | Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before update 10, 7.3… Affected: 7.2.0 through 7.4.3.13 |
| CVE-2024-25603 | 5.4 | Feb 21 | Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay… Affected: 7.2.0 through 7.4.3.4 |
| CVE-2024-25152 | 5.4 | Feb 21 | Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service… Affected: 7.2.0 through 7.4.2 |
| CVE-2024-25601 | 5.4 | Feb 21 | Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay… Affected: 7.2.0 through 7.4.2 |
| CVE-2024-25602 | 5.4 | Feb 21 | Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3… Affected: 7.2.0 through 7.4.2 |
| CVE-2024-25610 | 5.4 | Feb 20 | In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported… Affected: 7.2.0 through 7.4.3.12 |
| CVE-2024-25149 | 5.4 | Feb 20 | Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not… Affected: 7.2.0 through 7.4.1 |
| CVE-2024-25145 | 5.4 | Feb 7 | Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and… Affected: 7.2.0 through 7.4.3.11 |
| CVE-2023-42627 | 5.4 | Oct 17 | Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and earlier, and 7.4… Affected: 7.3.5 through 7.4.3.91 |
| CVE-2023-42628 | 5.4 | Oct 17 | Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and… Affected: 7.1.0 through 7.4.3.87 |
| CVE-2023-44310 | 5.4 | Oct 17 | Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79… Affected: 7.3.6 through 7.4.3.78 |
| CVE-2023-44309 | 5.4 | Oct 17 | Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay DXP 7.4 before update 54 allow remote… Affected: 7.4.2 through 7.4.3.53 |
| CVE-2023-42629 | 5.4 | Oct 17 | Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote… Affected: 7.4.2 through 7.4.3.87 |
| CVE-2023-33943 | 5.4 | May 24 | Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to… Affected: 7.4.3.21 through 7.4.3.62 |
| CVE-2023-33942 | 5.4 | May 24 | Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote… Affected: 7.4.3.50 |
| CVE-2023-33940 | 5.4 | May 24 | Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to… Affected: 7.4.0 through 7.4.3.30 |
| CVE-2023-33939 | 5.4 | May 24 | Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3… Affected: 7.1.0 through 7.4.3.12 |
| CVE-2023-33937 | 5.4 | May 24 | Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 before fix pack 18, and 7.2 before fix pack… Affected: 7.1.0 through 7.3.0 |
| CVE-2025-62275 | 5.3 | Nov 1 | Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update… Affected: 7.4.0 through 7.4.3.111 |
| CVE-2025-62257 | 5.3 | Oct 29 | Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through… Affected: 7.4.0 through 7.4.3.119 |
| CVE-2025-62256 | 5.3 | Oct 23 | Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older… Affected: 7.4.0 through 7.4.3.109 |
| CVE-2025-43808 | 5.3 | Sep 19 | The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3… Affected: 7.3.0 through 7.4.3.112 |
| CVE-2025-43805 | 5.3 | Sep 16 | Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not perform an… Affected: 7.3.0 through 7.4.3.111 |
| CVE-2025-43792 | 5.3 | Sep 15 | Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA… Affected: 7.4.0 through 7.4.3.105 |
| CVE-2025-43789 | 5.3 | Sep 12 | JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked… Affected: 7.4.0 through 7.4.3.119 |
| CVE-2025-43786 | 5.3 | Sep 9 | Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through… Affected: 7.4.0 through 7.4.3.128 |
| CVE-2025-43777 | 5.3 | Sep 9 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43758 | 5.3 | Aug 22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43751 | 5.3 | Aug 22 | User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43754 | 5.3 | Aug 21 | Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43749 | 5.3 | Aug 20 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2024-26270 | 5.3 | Feb 20 | The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in… Affected: 7.4.3.76 through 7.4.3.99 |
| CVE-2024-26268 | 5.3 | Feb 20 | User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix… Affected: 7.2.0 through 7.4.3.26 |
| CVE-2024-26267 | 5.3 | Feb 20 | In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported… Affected: 7.2.0 through 7.4.3.25 |
| CVE-2024-25605 | 5.3 | Feb 20 | The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older… Affected: 7.2.0 through 7.4.3.4 |
| CVE-2024-25146 | 5.3 | Feb 8 | Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with… Affected: 7.2.0 through 7.4.1 |
| CVE-2025-4655 | 5.0 | Aug 9 | SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through… Affected: 7.4.0 through 7.4.3.132 |