Liferay Portal & DXP - Cross-Site Scripting

Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entrycoverimagecaption.jsp, letting remote non-authenticated attackers inject JavaScript. id: CVE-2025-4576 info: name: Liferay Portal & DXP - Cross-Site...

Liferay Portal - Open Redirect

HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' U+FFFD, which allows remote...

CVE-2020-7961

CVE-2020-7961 针对 CVE-2020-7961 的利用脚本 通过 JSONWS 实现未经认证的远程代码执行 参考资料与启发 原始博文：https://codewhitesec.blogspot.com/2020/03/liferay-portal-json-vulns.html Synacktiv 博文：https://www.synacktiv.com/publications/how-to-exploit-liferay-cve-2020-7961-quick-journey-to-poc.html 代码库...

CVE-2020-7961-payloads

CVE-2020-7961-payloads 在 Liferay Portal 7.2.1 CE GA2 之前版本中，对不可信数据的反序列化允许远程攻击者通过 JSON Web 服务 JSONWS 执行任意代码。 步骤1 在 LifExp.java 中编写你的 payload 步骤2 使用 javac 编译 步骤3 设置你的日志服务器（也许你想用 "Burp Collaborator Client"） 步骤4 运行 poc.py ....享受吧 ; 😇 poc 代码由 mzer0one 编写 🙏 https://github.com/mzer0one/CVE-2020-7961-POC...

liferay-xss-7.2.1GA2-poc-report-CVE-2020-7934

LifeRay 7.2.1 GA2 の MyAccountPortlet における認証済み保存型XSS（検索結果で実行） LifeRay バージョン 7.1.0 から 7.2.1 GA2 において、ユーザーアカウントの名、ミドルネーム、姓フィールドはすべて保存型XSSの問題に対して脆弱です。任意のユーザーが特定のXSSペイロードを使用してこれらのフィールドを変更でき、データベースに保存されてユーザーを「感染」させます。その後、他のユーザーを検索するために検索機能を使用すると、ペイロードがレンダリングされます。感染したユーザーが検索結果に表示されると、XSSペイロードが実行されます。...

CVE-2011-1571

CVE-2011-1571 摘要 当使用 Apache Tomcat 时，Liferay Portal Community Edition CE 5.x 和 6.x（6.0.6 GA 之前版本）中的 XSL Content portlet 存在未指定的漏洞，允许远程攻击者通过未知向量执行任意命令。 CVE 详情 : https://www.cvedetails.com/cve/CVE-2011-1571/ PoC : http://xhe.myxwiki.org/xwiki/bin/view/XSLT/ApplicationLiferay Metasploit :...

CVE-2025-3639

CVE-2025-3639 PoC - Bypass di Login Liferay Portal/DXP Questo repository contiene un Proof of Concept PoC per CVE-2025-3639 , una vulnerabilità di bypass del login in Liferay Portal versioni 7.3.0–7.4.3.132 e Liferay DXP varie versioni da 2024.Q1 a 2025.Q1.6. Il PoC dimostra come un utente non...

MAL-001

MAL-001: Server-Side Template Injection di FreeMarker in Liferay Portal È stato scoperto un problema in Liferay - Portal =7.4.3.12-ga12. Inserendo contenuti dannosi nei modelli FTL, un attaccante può effettuare attacchi SSTI Server-Side Template Injection, che possono sfruttare gli oggetti espost...

CVE-2021-33332

Cross-site scripting XSS vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote attackers to inject arbitrary web script or HTML via the...

CVE-2021-33323

The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user...

CVE-2021-33990

Liferay Portal 6.2.5 allows Command=FileUpload=File=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the exploit reference link only shows frmfolders.html is accessible and does not demonstrate how an unauthorized user can upload a file...

CVE-2021-33334

The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms "Access in Site Administration" permission to vi...

CVE-2021-33325

The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text passwords are stored in the database if workflow is enabled for user creation, which allows attackers with access to the...

CVE-2021-33338

The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery CSRF attacks via the pauth parameter...

CVE-2021-33330

Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing CORS protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the...

CVE-2021-33321

Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true...

CVE-2021-33326

Cross-site scripting XSS vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window...

CVE-2021-33335

Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator...

CVE-2021-33339

Cross-site scripting XSS vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the comliferaysiteadminwebportletSiteAdminPortletname parameter...

CVE-2021-33322

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset tok...