Cross-site Request Forgery (CSRF)

Overview com.liferay.portal:portal-impl is a Portal Impl Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the orderUuid parameter in the server license registration process. An attacker can register a server license without authorization by tricking an...

com.liferay:com.liferay.source.formatter (>=1.0.443, <=1.0.454) potentially affected by CVE-2025-43794 via com.liferay.portal:com.liferay.portal.impl (2.18.0)

com.liferay.portal:com.liferay.portal.impl MAVEN version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.liferay.portal:com.liferay.portal.impl and may be impacted: - com.liferay:com.liferay.source.formatter =1.0.443, =1.0.454 Source cves:...

com.liferay:com.liferay.frontend.js.aui.web (>=1.0.0, <=1.0.23), com.liferay:com.liferay.frontend.js.web (>=1.0.26, <=1.0.70) potentially affected by CVE-2025-43794 via com.liferay.portal:com.liferay.portal.impl (2.11.0)

com.liferay.portal:com.liferay.portal.impl MAVEN version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.liferay.portal:com.liferay.portal.impl and may be impacted: - com.liferay:com.liferay.frontend.js.aui.web =1.0.0, =1.0.26, =1.0.70 Sourc...

Cross-site Scripting (XSS)

Liferay portal-impl is vulnerable to cross-site scripting XSS attacks. The library does not sanitize the portletID field when a portlet is deployed, allowing a malicious user to inject and execute arbitrary web script...