PT-2025-33824

Name of the Vulnerable Software and Affected Versions: Liferay Portal version 7.4.3.132 Liferay DXP versions 2025.Q2.0 through 2025.Q2.8 Liferay DXP versions 2025.Q1.0 through 2025.Q1.15 Description: A reflected cross-site scripting XSS vulnerability exists that allows a remote authenticated user...

CVE-2025-43737: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote authenticated user to inject JavaScript code via comliferayjournalwebportletJournalPortletbackURL parameter...

PT-2021-20117

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.0 through 7.3.3 Liferay DXP 7.1 fix pack 18 Liferay DXP 7.2 fix pack 5 through 7 Description A cross-site scripting XSS issue exists in the Journal module's add article menu, allowing remote attackers to inject...

PT-2021-20109

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.0.0 through 7.3.4 Liferay DXP versions 7.0 through 7.0 before fix pack 96 Liferay DXP versions 7.1 through 7.1 before fix pack 20 Liferay DXP versions 7.2 through 7.2 before fix pack 9 Description A cross-site scripti...