378 matches found
CVE-2011-1571
CVE-2011-1571 Zusammenfassung Nicht spezifizierte Sicherheitslücke im XSL-Content-Portlet in Liferay Portal Community Edition CE 5.x und 6.x vor 6.0.6 GA, wenn Apache Tomcat verwendet wird, ermöglicht entfernten Angreifern, beliebige Befehle über unbekannte Vektoren auszuführen. CVE-Details :...
CVE-2026-60728
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Portlet Services. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...
EUVD-2026-61410
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Portlet Services. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...
CVE-2026-21766
The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs. This only affects applications using the default...
CVE-2026-21766
The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs. This only affects applications using the default...
CVE-2026-21766 HCL Digital Experience and Digital Experience Compose insufficiently protects credentials
The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs. This only affects applications using the default...
CVE-2026-21766
CVE-2026-21766 affects the default login portlet in HCL Digital Experience and Digital Experience Compose. It describes insufficient protection of credentials, with the potential for sensitive information to be written to web server logs under specific use cases/configurations. The connected reco...
PT-2026-54521
Name of the Vulnerable Software and Affected Versions Plone versions 7.0.0 through 7.0.1 Plone versions 6.0.0 through 6.0.3 Plone versions 5.0.0 through 5.0.7 Description A critical remote code execution RCE flaw allows TALES injection via the Classic portlet. TALES is a templating language used ...
CVE-2026-8054
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' in the Publish Audit API endpoints /api/auditPublishing/get and /api/auditPublishing/getAll in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attackers to read, modify, or destroy arbitrar...
CVE-2025-6596 Vector inserts portlet labels as HTML, allowing for stored XSS through system messages
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/portlets.Js, resources/skins.Vector.Legacy.Js/portlets.Js. This issue affects Vecto...
CVE-2025-6596
CVE-2025-6596 affects Wikimedia Foundation Vector (MediaWiki skin). The issue is an XSS vulnerability in Vector’s portlets.Js files (resources/skins.Vector.Js/portlets.Js and resources/skins.Vector.Legacy.Js/portlets.Js) that affects Vector versions 1.40.0 and later, up to but not including 1.42....
CVE-2025-6596 Vector inserts portlet labels as HTML, allowing for stored XSS through system messages
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/portlets.Js, resources/skins.Vector.Legacy.Js/portlets.Js. This issue affects Vecto...
CVE-2021-33332
Cross-site scripting XSS vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote attackers to inject arbitrary web script or HTML via the...
Insecure Direct Object Reference (IDOR)
com.liferay.commerce, com.liferay.commerce.order.content.web is vulnerable to Insecure Direct Object Reference IDOR. The vulnerability is due to improper access control on the CommerceOrderPortletcommerceOrderId parameter, which allows an attacker to access shipment addresses from other virtual...
Reflected Cross-site Scripting (XSS)
com.liferay, com.liferay.product.navigation.control.menu.web is vulnerable to reflected cross-site scripting XSS. The vulnerability is due to improper validation of the comliferaylayoutadminwebportletGroupPagesPortletbackURLTitle parameter, which allows an attacker to inject arbitrary web script ...
CVE-2025-62253
Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redire...
EUVD-2025-36353
Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redire...
Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter
Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redire...
GHSA-2PWH-9Q9Q-5R9C Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter
Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redire...
CVE-2025-62253
Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redire...