PO
Product
Portal
210
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 27Medium 174Low 3
Watch
Add Portal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-43748 | 6.8 | Aug 20 | Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9,… Affected: 7.0.0 through 7.4.3.119 |
| CVE-2025-62258 | 6.5 | Oct 27 | CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and… Affected: 7.4.0 through 7.4.3.107 |
| CVE-2025-62261 | 6.5 | Oct 27 | Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older… Affected: 7.4.0 through 7.4.3.99 |
| CVE-2025-62247 | 6.5 | Oct 22 | Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-62250 | 6.5 | Oct 21 | Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-62251 | 6.5 | Oct 13 | Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows… Affected: 7.3.0 through 7.4.3.119 |
| CVE-2025-43825 | 6.5 | Oct 3 | A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43819 | 6.5 | Sep 24 | A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.3.121 through 7.4.3.131 |
| CVE-2025-43814 | 6.5 | Sep 22 | In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and… Affected: 7.4.0 through 7.4.3.112 |
| CVE-2025-43799 | 6.5 | Sep 15 | Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update… Affected: 7.4.0 through 7.4.3.111 |
| CVE-2025-43784 | 6.5 | Sep 10 | Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through… Affected: 7.4.0 through 7.4.3.124 |
| CVE-2025-43763 | 6.5 | Sep 8 | A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13,… Affected: 7.4.0 through 7.4.3.131 |
| CVE-2025-43764 | 6.5 | Aug 23 | Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay… Affected: 7.4.3.0 through 7.4.3.131 |
| CVE-2025-43762 | 6.5 | Aug 22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43752 | 6.5 | Aug 22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.3.0 through 7.4.3.132 |
| CVE-2025-43750 | 6.5 | Aug 20 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43745 | 6.5 | Aug 19 | A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2024-26265 | 6.5 | Feb 20 | The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack… Affected: 7.2.0 through 7.4.3.15 |
| CVE-2024-25604 | 6.5 | Feb 20 | Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions… Affected: 7.2.0 through 7.4.3.4 |
| CVE-2024-25144 | 6.5 | Feb 8 | The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and… Affected: 7.2.0 through 7.4.3.26 |
| CVE-2024-25143 | 6.5 | Feb 7 | The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older… Affected: 7.2.0 through 7.3.6 |
| CVE-2025-62267 | 6.1 | Oct 31 | Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through… Affected: 7.4.3.35 through 7.4.3.111 |
| CVE-2025-62264 | 6.1 | Oct 31 | Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1… Affected: 7.4.3.8 through 7.4.3.111 |
| CVE-2025-62266 | 6.1 | Oct 30 | By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through… Affected: 7.4.0 through 7.4.3.119 |
| CVE-2025-62253 | 6.1 | Oct 27 | Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through… Affected: 7.4.0 through 7.4.3.97 |
| CVE-2025-62255 | 6.1 | Oct 23 | Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP… Affected: 7.4.0 through 7.4.3.101 |
| CVE-2025-62249 | 6.1 | Oct 21 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43830 | 6.1 | Oct 8 | Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4… Affected: 7.3.2 through 7.4.3.111 |
| CVE-2025-43817 | 6.1 | Sep 29 | Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through… Affected: 7.4.3.74 through 7.4.3.111 |
| CVE-2025-43818 | 6.1 | Sep 29 | Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through… Affected: 7.4.3.35 through 7.4.3.110 |
| CVE-2025-43815 | 6.1 | Sep 29 | Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, and… Affected: 7.4.3.102 through 7.4.3.110 |
| CVE-2025-43779 | 6.1 | Sep 24 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92… Affected: 7.4.0 through 7.4.3.112 |
| CVE-2025-43804 | 6.1 | Sep 16 | Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 allows remote… Affected: 7.4.3.93 through 7.4.3.111 |
| CVE-2025-43802 | 6.1 | Sep 15 | Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1… Affected: 7.4.3.51 through 7.4.3.111 |
| CVE-2025-43800 | 6.1 | Sep 15 | Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7.4 GA through update… Affected: 7.4.3.20 through 7.4.3.111 |
| CVE-2025-43791 | 6.1 | Sep 15 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and… Affected: 7.3.0 through 7.4.3.111 |
| CVE-2025-43795 | 6.1 | Sep 12 | Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA… Affected: 7.1.0 through 7.4.3.101 |
| CVE-2025-43783 | 6.1 | Sep 10 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.3.73 through 7.4.3.128 |
| CVE-2025-43785 | 6.1 | Sep 10 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4… Affected: 7.4.3.45 through 7.4.3.128 |
| CVE-2025-43781 | 6.1 | Sep 9 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13 and… Affected: 7.4.3.110 through 7.4.3.128 |
| CVE-2025-43778 | 6.1 | Sep 9 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43765 | 6.1 | Aug 23 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.3.0 through 7.4.3.131 |
| CVE-2025-43767 | 6.1 | Aug 23 | Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0… Affected: 7.4.3.86 through 7.4.3.131 |
| CVE-2025-43769 | 6.1 | Aug 23 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1… Affected: 7.4.0 through 7.4.3.131 |
| CVE-2025-43770 | 6.1 | Aug 23 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.0 through 7.4.3.131 |
| CVE-2025-43761 | 6.1 | Aug 22 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.0 through 7.4.3.131 |
| CVE-2025-43742 | 6.1 | Aug 20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43735 | 6.1 | Aug 12 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.0 through 7.4.3.131 |
| CVE-2025-4576 | 6.1 | Aug 8 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-4604 | 6.1 | Aug 4 | The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 through 7.4.3.132 |