PO
Product
Portal
210
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 27Medium 174Low 3
Watch
Add Portal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-62248 | 4.8 | Oct 22 | A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43794 | 4.8 | Sep 15 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4,… Affected: 7.4.0 through 7.4.3.111 |
| CVE-2023-37940 | 4.8 | Dec 17 | Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through… Affected: 7.0.0 through 7.4.3.87 |
| CVE-2023-47798 | 4.6 | Feb 8 | Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate… Affected: 7.2.0 through 7.3.0 |
| CVE-2025-62262 | 4.4 | Oct 27 | Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q3.1… Affected: 7.4.0 through 7.4.3.97 |
| CVE-2025-62252 | 4.3 | Oct 13 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5,… Affected: 7.4.0 through 7.4.3.111 |
| CVE-2025-62242 | 4.3 | Oct 13 | Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1… Affected: 7.4.3.4 through 7.4.3.111 |
| CVE-2025-62244 | 4.3 | Oct 13 | Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through… Affected: 7.3.1 through 7.4.3.111 |
| CVE-2025-62245 | 4.3 | Oct 10 | Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA… Affected: 7.4.1 through 7.4.3.112 |
| CVE-2025-43827 | 4.3 | Sep 30 | Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1… Affected: 7.4.0 through 7.4.3.117 |
| CVE-2025-43810 | 4.3 | Sep 22 | Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1… Affected: 7.4.0 through 7.4.3.112 |
| CVE-2025-43806 | 4.3 | Sep 22 | Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 does not properly… Affected: 7.4.0 through 7.4.3.112 |
| CVE-2025-43809 | 4.3 | Sep 19 | Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay… Affected: 7.4.0 through 7.4.3.111 |
| CVE-2025-43803 | 4.3 | Sep 19 | Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP… Affected: 7.4.3.0 through 7.4.3.119 |
| CVE-2025-43788 | 4.3 | Sep 12 | The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user… Affected: 7.4.3.94 through 7.4.3.124 |
| CVE-2025-43782 | 4.3 | Sep 11 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7, 2024.Q1.1 through 2024.Q1.12, and 7.4… Affected: 7.4.0 through 7.4.3.124 |
| CVE-2025-43743 | 4.3 | Aug 19 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43739 | 4.3 | Aug 19 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43736 | 4.3 | Aug 12 | A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.3.0 through 7.4.3.132 |
| CVE-2025-2565 | 4.3 | Mar 20 | The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through… Affected: 7.4.0 through 7.4.3.128 |
| CVE-2024-25150 | 4.3 | Feb 20 | Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before… Affected: 7.2.0 through 7.4.2 |
| CVE-2023-3426 | 4.3 | Aug 2 | The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated… Affected: 7.4.3.81 through 7.4.3.85 |
| CVE-2023-33947 | 4.3 | May 24 | The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows… Affected: 7.4.3.4 through 7.4.3.60 |
| CVE-2023-33946 | 4.3 | May 24 | The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows… Affected: 7.4.3.4 through 7.4.3.48 |