MAL-001

MAL-001: FreeMarker Server-Side Template Injection in Liferay Portal An issue was discovered in Liferay - Portal =7.4.3.12-ga12. By inserting malicious content in the FTL Templates, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects ...

CVE-2011-1571

CVE-2011-1571 Summary Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition CE 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors. CVE Detail :...

CVE-2025-3639

CVE-2025-3639 PoC - Liferay Portal/DXP Login Bypass This repository contains a Proof of Concept PoC for CVE-2025-3639 , a login bypass vulnerability in Liferay Portal versions 7.3.0–7.4.3.132 and Liferay DXP various versions from 2024.Q1 to 2025.Q1.6. The PoC demonstrates how an unauthenticated...

CVE-2020-7961

CVE-2020-7961 Exploit script for CVE-2020-7961 Unauthenticated Remote code execution via JSONWS References & inspirations original blogpost : https://codewhitesec.blogspot.com/2020/03/liferay-portal-json-vulns.html synacktiv blogpost :...

CVE-2019-16891-Liferay-deserialization-RCE

CVE-2019-16891-Liferay-deserialization-RCE...

CVE-2020-7961-Mass

CVE-2020-7961-Mass CVE-2020–7961 Mass exploit for Script Kiddies Tested on: Kali Linux, Windows,... Requirements: apt install python3 pip3 install requests colorama Usage: python3 rce.py target url | For a single target python3 mass.py list url | For a list target Saved file to: linux.txt, win.tx...

Liferay-CE-Portal-Java-Deserialization

Liferay-CE-Portal-Java-Deserialization This repo contains PoC for the remote code execution vulnerability of Liferay CE Portal! Payloads I already shared payloads in repo. You must find the right syntax by brute-force method.Payloads I share are for time-based proof of concept sleep 10. The...

CVE-2020-7961-payloads

CVE-2020-7961-payloads Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services JSONWS Step 1 Write Your payload in LifExp.java Step 2 Compile it with javac Step 3 make your log server Maybe you want to use...

liferay-ga4-rce-research

Liferay CE 7.0.3 GA4 — Vulnerability Research RAPTOR Loop-Hunt A security audit of Liferay Portal CE 7.0.3 GA4 git tag 7.0.3-ga4, commit b2d7cc68a performed with the RAPTOR loop-hunt methodology: deterministic recon → 25 isolated generator agents reading raw source → 22 independent judge agents...

Liferay Portal & DXP - Cross-Site Scripting

Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entrycoverimagecaption.jsp, letting remote non-authenticated attackers inject JavaScript. id: CVE-2025-4576 info: name: Liferay Portal & DXP - Cross-Site...

Liferay Portal - Cross-site Scripting

A Cross-site scripting XSS vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the tag parameter. id:...

Liferay Portal - Open Redirect

HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' U+FFFD, which allows remote...

Liferay Portal - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated...

liferay-xss-7.2.1GA2-poc-report-CVE-2020-7934

Authenticated Stored XSS in LifeRay 7.2.1 GA2 via MyAccountPortlet executed by Search Results In LifeRay version 7.1.0 through 7.2.1 GA2 the First Name, Middle Name, and Last Name fields for user accounts are all vulnerable to a Stored XSS issue. Any user can modify these fields with a particular...

audit-xss-cve-2020-7934

CVE 2020-7934 How to run CVE Requirements 1. docker Remarks it's possible put the script attack online given the js code http://yourjavascript.com/ Our Js script online for the attack html Commands for configuration 1. go to root folder of this project 2. run "sudo docker-compose up --build" 3. n...

Malware in liferay-workspace-scripts

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in liferay-workspace-scripts (npm)

Source: amazon-inspector 3395e72ef77703732691fce21359206afea7598fb3d1dab29ded4b2e1c7cd28f package.json declares the sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz instead of a registry version range. On npm install, npm...

MAL-2026-17772 Malicious code in liferay-workspace-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3395e72ef77703732691fce21359206afea7598fb3d1dab29ded4b2e1c7cd28f package.json declares the sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz...

Malicious code in liferay-workspace-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3395e72ef77703732691fce21359206afea7598fb3d1dab29ded4b2e1c7cd28f package.json declares the sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz...

Liferay Portal Unauthenticated < 7.2.1 CE GA2 - Remote Code Execution

Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services JSONWS. id: CVE-2020-7961 info: name: Liferay Portal Unauthenticated 7.2.1 CE GA2 - Remote Code Execution author: dwisiswant0 severity: critical description: Liferay Portal prior to 7.2.1 ...