CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

22 matches found

Veracode•added 2025/12/13 4:43 a.m.•4 views

Stored Cross-Site Scripting

Liferay Portal and Liferay DXP are vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to insufficient sanitization of user-controlled input, where the name of a fieldset in Kaleo Forms Admin is stored without proper escaping, allowing an authenticated attacker to persistently...

6.1CVSS5.7AI score0.00044EPSS

Exploits0References3Affected Software1

EUVD•added 2025/10/03 8:7 p.m.•1 views

EUVD-2025-27270

Malicious code in bioql PyPI...

4.8CVSS6.3AI score0.00044EPSS

Exploits0References1

Veracode•added 2025/10/03 10:13 a.m.•4 views

Denial Of Service (DoS)

com.liferay.portal.workflow.kaleo.forms.web is vulnerable to Denial of Service DoS. The vulnerability is due to insufficient restrictions on saving request parameters in the portlet session because the application allows unvalidated request data to be stored in memory; an attacker can send crafte...

7.1CVSS6.8AI score0.00569EPSS

Exploits0References6Affected Software1

RedhatCVE•added 2025/09/11 1:22 a.m.•5 views

CVE-2025-43778

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 allows an...

4.8CVSS5.7AI score0.00044EPSS

Exploits0References1

Snyk•added 2025/09/09 3:30 a.m.•3 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Name field in Kaleo Forms Admin. An attacker can execute arbitrary JavaScript code in the context of the user's browser by injecting a malicious payload that is stored and rendered without proper...

6.1CVSS5.2AI score0.00044EPSS

Exploits0References2

OSV•added 2025/09/09 3:30 a.m.•2 views

GHSA-CPG4-QCJ8-42GP Liferay Portal is vulnerable to XSS attack through fieldset name in Kaleo Forms Admin

4.8CVSS5.8AI score0.00044EPSS

Exploits0References4

Github Security Blog•added 2025/09/09 3:30 a.m.•4 views

Liferay Portal is vulnerable to XSS attack through fieldset name in Kaleo Forms Admin

6.1CVSS5.7AI score0.00044EPSS

Exploits0References4Affected Software1

NVD•added 2025/09/09 2:15 a.m.•2 views

CVE-2025-43778

6.1CVSS0.00044EPSS

Exploits0References1

OSV•added 2025/09/09 2:15 a.m.•0 views

CVE-2025-43778

6.1CVSS5.8AI score0.00044EPSS

Exploits0References1

CVE•added 2025/09/09 1:21 a.m.•10 views

CVE-2025-43778

The CVE-2025-43778 issue is a Stored XSS in Liferay Portal and Liferay DXP, exploitable via the name of a fieldset in Kaleo Forms Admin. Affected products/versions include Liferay Portal 7.4.0–7.4.3.132 and Liferay DXP across multiple 2024–2025 quarterly releases (e.g., 2025.Q1.0–Q1.16, 2025.Q2.0...

6.1CVSS5.3AI score0.00044EPSS

Exploits0References1Affected Software2

Vulnrichment•added 2025/09/09 1:21 a.m.•2 views

CVE-2025-43778

4.8CVSS5.3AI score0.00044EPSS

Exploits0References1

Cvelist•added 2025/09/09 1:21 a.m.•4 views

CVE-2025-43778

4.8CVSS0.00044EPSS

Exploits0References1

Positive Technologies•added 2025/09/09 12:0 a.m.•2 views

PT-2025-36542

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.132 Liferay DXP versions 2024.Q1.1 through 2024.Q1.20 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q3.0 through 2024.Q3.13 Liferay DXP versions 2024.Q4.0 through...

4.8CVSS5.6AI score0.00044EPSS

Exploits0References8

RedhatCVE•added 2025/09/06 2:27 a.m.•1 views

CVE-2025-43772

Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions does not restrict the saving of request parameters in the portlet session, which allows remote attackers to consume system memory leading to denial-of-servic...

7.1CVSS7AI score0.00569EPSS

Exploits0References1

Snyk•added 2025/09/04 12:30 p.m.•3 views

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to not saving the request parameters in the portlet session. An attacker can exhaust system memory by sending crafted HTTP requests. Details Denial of Service DoS describes a family of attacks, all aimed at...

7.1CVSS7.1AI score0.00569EPSS

Exploits0References2

OSV•added 2025/09/04 12:30 p.m.•3 views

GHSA-J4FW-4MHR-HC45 Liferay Portal Vulnerable to Denial of Service in Kaleo Forms Admin

7.1CVSS7.1AI score0.00569EPSS

Exploits0References6

Github Security Blog•added 2025/09/04 12:30 p.m.•4 views

Liferay Portal Vulnerable to Denial of Service in Kaleo Forms Admin

7.1CVSS7.1AI score0.00569EPSS

Exploits0References6Affected Software1

NVD•added 2025/09/04 10:42 a.m.•3 views

CVE-2025-43772