CVE-2022-45320

CVE-2022-45320 affects Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16. A remote authenticated user can become the owner of a wiki page by editing it (privilege escalation). This is a wiki-level ownership issue; exploitation sta...

CVE-2021-29038

CVE-2021-29038 affects Liferay Portal 7.2.0–7.3.5 and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, and 7.2 before fix pack 17. The issue: password reminder answers are not obfuscated on the page, enabling attackers to perform MITM or shoulder-surfing attacks to steal those a...

CVE-2021-38268

CVE-2021-38268 affects Liferay Portal 7.0.0–7.3.6 and Liferay DXP 7.0–7.3 with the Dynamic Data Mapping module. The issue: default permissions for site members are set incorrectly, allowing remote authenticated users with the site member role to add and duplicate forms via the UI or the API. Affe...

CVE-2021-38263

CVE-2021-38263 corresponds to a cross-site scripting (XSS) vulnerability in the Server module’s script console of Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20, and 7.2 before fix pack 10. The issue permits remote attackers to inject arbitrary w...

CVE-2020-15841

Liferay Portal before 7.3.0 and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4 fail to safely test LDAP connections, allowing remote attackers to obtain the LDAP server’s password via the Test LDAP Connection feature. Affected products: Liferay Portal (pre-7...

CVE-2025-4388

Liferay Portal/DXP CVE-2025-4388 is a reflected XSS affecting Portal 7.4.0–7.4.3.131 and DXP 2024.Q1.1–Q4.5 across multiple 2024 releases up to 7.4 GA with update 92. The vulnerability allows a remote, unauthenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app...

CVE-2020-15840

CVE-2020-15840 affects Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, 7.1, 7.0. The underlying issue is that the property portlet.resource.id.banned.paths.regexp can be bypassed via doubled encoded URLs, enabling an authorization bypass as described in multiple sources. ...

CVE-2020-15842

CVE-2020-15842 affects Liferay Portal before 7.3.0 and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5. Insecure deserialization allows MITM attackers to execute arbitrary code via crafted serialized payloads. Mitigation: upgrade to Liferay Portal 7.3.0+ or D...

CVE-2020-15839

CVE-2020-15839 affects Liferay Portal before 7.3.3 and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, where there is no restriction on the size of multipart/form-data POST uploads. This allows remote authenticated users to cause a denial-of-service by uploading large files. The ava...

CVE-2023-33946

Summary: CVE-2023-33946 affects Liferay Portal 7.4.3.4–7.4.3.48 and Liferay DXP 7.4 before update 49, where the Object module fails to properly isolate objects across different virtual instances. This allows remote authenticated users in one instance to view objects in another via the OAuth 2 sco...

CVE-2022-25146

The CVE-2022-25146 affects Liferay Portal: v7.4.3.4–v7.4.3.8 and Liferay DXP 7.4 before update 5, in the Remote App module. Root cause: the origin of event messages is not validated against the Remote App origin, allowing CSRF token exfiltration via a crafted event message. Impact: partial confid...

CVE-2021-29040

CVE-2021-29040 concerns Liferay Portal (versions 7.3.4 and earlier) and Liferay DXP (7.0 before fix pack 97, 7.1 before fix pack 20, 7.2 before fix pack 10). The vulnerability arises from overly verbose JSON web service error messages that can aid an attacker in crafting more focused inputs for f...

CVE-2024-25604

CVE-2024-25604 affects Liferay Portal 7.2.0–7.4.3.4 and Liferay DXP 7.4.13, 7.3 before SP3, 7.2 before FP17 (and older unsupported versions), where the system does not properly enforce permissions. Specifically, remote authenticated users with the VIEW permission can edit their own permissions vi...

CVE-2021-33338

The CVE affects Liferay Portal/Liferay DXP: Layout module in 7.1.0–7.3.2 and DXP 7.1 before fix pack 19, 7.2 before fix pack 6. The flaw exposes the CSRF token in URLs via the p_auth parameter, enabling MITM to obtain the token and perform CSRF attacks. No exploitation details are provided in the...

CVE-2024-25605

The CVE-2024-25605 issue affects Liferay Portal/DXP: The Journal module (versions 7.2.0–7.4.3.4; DXP 7.4.13; 7.3 before SP3; 7.2 before FP17) grants guest users view permission to web content templates by default, enabling viewing of templates via UI or API. Root cause is Incorrect/Default Permis...

CVE-2021-29043

The CVE-2021-29043 issue affects Liferay Portal/DXP: Portal Store module versions 7.0.0–7.3.5 (and Liferay DXP 7.0 prior to fix pack 97, 7.1 prior to fix pack 21, 7.2 prior to fix pack 10, 7.3 prior to fix pack 1) do not obfuscate the S3 store proxy password. This enables an attacker to harvest t...

CVE-2021-33335

CVE-2021-33335 affects Liferay Portal 7.0.3–7.3.4 and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9. A remote authenticated user with permission to update/edit users can takeover a company administrator account by editing the company administrator user. Root cause is privilege esc...

CVE-2021-33333

The CVE-2021-33333 entry describes a vulnerability in the Portal Workflow module of Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 6, where improper permission checks allow remote authenticated users to view and delete wor...

CVE-2021-33336

CVE-2021-33336 is a documented cross-site scripting (XSS) vulnerability affecting the Journal module’s add article menu in Liferay Portal 7.3.0–7.3.3 and Liferay DXP 7.1 fix pack 18 and 7.2 fix packs 5–7. The issue allows remote attackers to inject arbitrary Web script or HTML via the parameter _...

CVE-2021-38267

CVE-2021-38267 is a Cross-site Scripting (XSS) vulnerability disclosed for the Blogs module in Liferay Portal 7.3.2–7.3.6 and Liferay DXP 7.3 before fix pack 2. The issue enables remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_portlet_BlogsAdminPortlet_title...

CVE-2021-38269

The CVE-2021-38269 affects the Gogo Shell module in Liferay Portal (versions 7.1.0–7.3.6 and 7.4.0) and Liferay DXP (7.1 before fix pack 23, 7.2 before fix pack 13, 7.3 before fix pack 2). It enables remote attackers to inject arbitrary web script or HTML via the output of a Gogo Shell command, i...

CVE-2022-26597

This CVE-2022-26597 affects Liferay Portal 7.3.0–7.4.0 (and Liferay DXP 7.3 before Service Pack 3) via the Layout module’s Open Graph integration. The root cause is a cross-site scripting (XSS) vulnerability that lets remote attackers inject arbitrary web script or HTML through the site name. The...

CVE-2024-25602

Summary (CVE-2024-25602) Stored cross-site scripting (XSS) vulnerability in the Users Admin module’s edit user page of Liferay Portal (7.2.0–7.4.2) and Liferay DXP (7.3 before SP3, 7.2 before fix pack 17; older unsupported versions). An authenticated remote user can inject arbitrary web script or...

CVE-2024-25147

Affects Liferay Portal: HtmlUtil.escapeJsLink XSS in versions 7.2.0–7.4.1 (and older unsupported) and Liferay DXP 7.3 before SP3, 7.2 before FP15. Root cause is insufficient sanitization in HtmlUtil.escapeJsLink, allowing remote attackers to inject arbitrary web script or HTML via crafted javascr...

CVE-2021-38265

CVE-2021-38265 is an XSS vulnerability in the Asset module of Liferay Portal, affecting version 7.3.4–7.3.6. An attacker can remotely inject arbitrary web script or HTML when creating a collection page using the parameter _com_liferay_asset_list_web_portlet_AssetListPortlet_title. The connected d...

CVE-2022-26593

CVE-2022-26593 is an XSS vulnerability affecting Liferay Portal/DXP: Asset module’s asset categories selector in Liferay Portal 7.3.3–7.4.0 and Liferay DXP 7.3 before SP3. The issue allows remote attackers to inject arbitrary web script/HTML via the name of an asset category. Root cause is a cros...

CVE-2024-26269

CVE-2024-26269 is an XSS vulnerability in the Frontend JS module’s portlet.js affecting Liferay Portal 7.2.0–7.4.3.37 and Liferay DXP 7.4 (pre-38), 7.3 (pre-11), 7.2 (pre-fix pack 20), including older unsupported versions. The flaw allows remote attackers to inject arbitrary web script via the UR...

CVE-2022-42128

CVE-2022-42128 affects Liferay Portal 7.4.1–7.4.3.4 and Liferay DXP 7.4 GA. The Hypermedia REST APIs module fails to properly enforce permissions, allowing remote attackers to obtain a WikiNode object through WikiNodeResource.getSiteWikiNodeByExternalReferenceCode. Impact is information disclosur...

CVE-2024-25603

The CVE-2024-25603 issue affects Liferay Portal and Liferay DXP where a stored XSS flaw exists in the Dynamic Data Mapping (DDMForm) component. The vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter. Affected versions include Portal...

CVE-2024-38002

The CVE-2024-38002 issue affects Liferay Portal and Liferay DXP, where the workflow component does not properly enforce permission checks when updating a workflow definition via the headless API. This allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE...

CVE-2021-38266

The CVE-2021-38266 issue affects the Portal Security module in Liferay Portal up to version 7.2.1 and Liferay DXP up to 7.2 (and older 7.0/7.1) where LDAP user import can fail, enabling remote attackers to prevent a legitimate user from authenticating by signing in as an LDAP user.根 The root caus...

CVE-2022-26595

CVE-2022-26595 affects Liferay Portal 7.3.7, 7.4.0, 7.4.1 and Liferay DXP 7.2 FP13, plus 7.3 FP2. The vulnerability arises from inadequate permission checks when accessing a list of sites/groups, allowing remote authenticated users to view sites/groups via the user’s site membership UI. Concrete ...

CVE-2024-25152

CVE-2024-25152 affects Liferay Portal 7.2.0–7.4.2 and Liferay DXP 7.3 (before SP3) / 7.2 (before FP17) and older unsupported versions. The vulnerability is a stored XSS in the Message Board widget triggered via the filename of an attachment, allowing remote authenticated users to inject arbitrary...

CVE-2024-25608

Summary: The CVE affects Liferay Portal and Liferay DXP versions as described in multiple sources. Root cause: HtmlUtil.escapeRedirect can be bypassed using the Replacement Character (U+FFFD), enabling redirection to arbitrary external URLs. Affected products and versions: Liferay Portal 7.2.0–7....

CVE-2021-33337

CVE-2021-33337 is an XSS vulnerability in the Liferay Portal/DXP Document Library add document menu. Affected products: Liferay Portal 7.3.0–7.3.4 and Liferay DXP 7.1 (before fix pack 20) and 7.2 (before fix pack 9). The issue allows remote attackers to inject arbitrary HTML/script via the parame...

CVE-2024-25609

CVE-2024-25609 affects Liferay Portal 7.2.0–7.4.3.12 and Liferay DXP 7.4 before update 9, 7.3 SP3, 7.2 FP15–FP18, and older unsupported versions. The issue is a bypass of HtmlUtil.escapeRedirect caused by an incomplete fix from CVE-2022-28977, enabling remote attackers to redirect users to arbitr...

CVE-2024-26266

CVE-2024-26266 corresponds to multiple stored XSS vulnerabilities in Liferay Portal and Liferay DXP. Affected products/versions include Liferay Portal 7.2.0 through 7.4.3.13, and DXP releases prior to certain fixes, where remote authenticated users can inject arbitrary script/HTML via crafted pay...

CVE-2023-33945

SQL injection in the upgrade workflow affects Liferay Portal 7.3.1–7.4.3.17 (SQL Server) and Liferay DXP 7.3 pre-update 6 and 7.4 pre-update 18. The issue allows arbitrary SQL commands via a database table’s primary key index name and is exploitable only when chained with other attacks; exploitat...

CVE-2021-33331

Open redirect vulnerability (CVE-2021-33331) in the Notifications module of Liferay Portal 7.0.0–7.3.1 and Liferay DXP 7.0–7.2 allows an attacker to redirect users to arbitrary external URLs via the redirect parameter. Affected versions require applying fixes: Portal 7.0.x before fix pack 94, 7.1...

CVE-2022-42123

CVE-2022-42123 describes a Zip Slip vulnerability in the Elasticsearch Connector used by Liferay Portal (versions 7.3.3–7.4.3.18) and Liferay DXP (7.3 before update 6; 7.4 before update 19). The underlying issue allows an attacker to create or overwrite files on the filesystem via a malicious Ela...

CVE-2023-33944

CVE-2023-33944 is an XSS vulnerability in the Liferay Layout module affecting Liferay Portal 7.3.4–7.4.3.68 and Liferay DXP 7.3 (pre‑update 24) and 7.4 (pre‑update 69). The flaw permits remote attackers to inject arbitrary script/HTML via a crafted payload in a container type layout fragment’s UR...

CVE-2025-2565

CVE-2025-2565 affects Liferay Portal 7.4.0–7.4.3.126 and Liferay DXP 2024.Q3.0 through 2024.Q2.x, 2023.x releases, where an unauthorized user can obtain entry data from forms. Connected sources provide concrete details on affected products and versions, and identify the underlying issue as data e...

CVE-2021-33339

CVE-2021-33339 is a cross-site scripting (XSS) vulnerability affecting Liferay Portal 7.2.1–7.3.4 and Liferay DXP 7.2 prior to fix pack 9. The issue is triggered via the _com_liferay_site_admin_web_portlet_SiteAdminPortlet_name parameter in the Fragment module, enabling remote attackers to inject...

CVE-2023-44308

CVE-2023-44308 describes an open redirect in Liferay DXP’s adaptive media administration page. Public details specify that versions affected are Liferay DXP 2023.Q3 before patch 6 and 7.4 GA through update 92. The vulnerability arises via the parameter _com_liferay_adaptive_media_web_portlet_AMPo...

CVE-2024-25145

CVE-2024-25145 describes a stored cross-site scripting (XSS) vulnerability in the Portal Search module’s Search Result app of Liferay Portal 7.2.0–7.4.3.11, and older unsupported versions, plus certain Liferay DXP builds. The issue allows remote authenticated users to inject arbitrary script/HTML...

CVE-2021-29044

Summary (CVE-2021-29044) : This XSS vulnerability affects Liferay Portal 7.0.0–7.3.5 and Liferay DXP 7.0–7.3 with various fix-pack gaps. The issue is an input136 via the parameter _com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments in the Site module membership request administration p...

CVE-2021-29048

CVE-2021-29048 is an XSS vulnerability in the Liferay Layout module, affecting Liferay Portal 7.3.4–7.3.5 and Liferay DXP 7.2 before fix pack 11, plus Liferay DXP 7.3 before fix pack 1. The issue arises in the page administration page via the parameter _com_liferay_layout_admin_web_portlet_GroupP...

CVE-2023-33948

The CVE-2023-33948 entry concerns the Dynamic Data Mapping module in Liferay Portal 7.4.3.67 and Liferay DXP 7.4 update 67, where Document and Media files can be downloaded from a Form without proper restrictions, allowing remote attackers to retrieve arbitrary files via crafted URLs. Connected s...

CVE-2021-33322

CVE-2021-33322 affects Liferay Portal 7.3.0 and earlier and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5. The root cause is that password reset tokens are not invalidated after a user changes their password, allowing a remote attacker to change the user’s ...

CVE-2021-33326

CVE-2021-33326 is an XSS vulnerability in the Frontend JS module of Liferay Portal 7.3.4 and earlier and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9. The issue lets remote attackers inject arbitrary script/HTML via the title of a modal window. Affected pr...