CVE-2022-45320

CVE-2022-45320 affects Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16. A remote authenticated user can become the owner of a wiki page by editing it (privilege escalation). This is a wiki-level ownership issue; exploitation sta...

CVE-2021-29038

CVE-2021-29038 affects Liferay Portal 7.2.0–7.3.5 and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, and 7.2 before fix pack 17. The issue: password reminder answers are not obfuscated on the page, enabling attackers to perform MITM or shoulder-surfing attacks to steal those a...

CVE-2021-38268

CVE-2021-38268 affects Liferay Portal 7.0.0–7.3.6 and Liferay DXP 7.0–7.3 with the Dynamic Data Mapping module. The issue: default permissions for site members are set incorrectly, allowing remote authenticated users with the site member role to add and duplicate forms via the UI or the API. Affe...

CVE-2024-25604

CVE-2024-25604 affects Liferay Portal 7.2.0–7.4.3.4 and Liferay DXP 7.4.13, 7.3 before SP3, 7.2 before FP17 (and older unsupported versions), where the system does not properly enforce permissions. Specifically, remote authenticated users with the VIEW permission can edit their own permissions vi...

CVE-2021-29040

CVE-2021-29040 concerns Liferay Portal (versions 7.3.4 and earlier) and Liferay DXP (7.0 before fix pack 97, 7.1 before fix pack 20, 7.2 before fix pack 10). The vulnerability arises from overly verbose JSON web service error messages that can aid an attacker in crafting more focused inputs for f...

CVE-2024-25605

The CVE-2024-25605 issue affects Liferay Portal/DXP: The Journal module (versions 7.2.0–7.4.3.4; DXP 7.4.13; 7.3 before SP3; 7.2 before FP17) grants guest users view permission to web content templates by default, enabling viewing of templates via UI or API. Root cause is Incorrect/Default Permis...

CVE-2021-38267

CVE-2021-38267 is a Cross-site Scripting (XSS) vulnerability disclosed for the Blogs module in Liferay Portal 7.3.2–7.3.6 and Liferay DXP 7.3 before fix pack 2. The issue enables remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_portlet_BlogsAdminPortlet_title...

CVE-2024-25602

Summary (CVE-2024-25602) Stored cross-site scripting (XSS) vulnerability in the Users Admin module’s edit user page of Liferay Portal (7.2.0–7.4.2) and Liferay DXP (7.3 before SP3, 7.2 before fix pack 17; older unsupported versions). An authenticated remote user can inject arbitrary web script or...

CVE-2022-26597

This CVE-2022-26597 affects Liferay Portal 7.3.0–7.4.0 (and Liferay DXP 7.3 before Service Pack 3) via the Layout module’s Open Graph integration. The root cause is a cross-site scripting (XSS) vulnerability that lets remote attackers inject arbitrary web script or HTML through the site name. The...

CVE-2024-25147

Affects Liferay Portal: HtmlUtil.escapeJsLink XSS in versions 7.2.0–7.4.1 (and older unsupported) and Liferay DXP 7.3 before SP3, 7.2 before FP15. Root cause is insufficient sanitization in HtmlUtil.escapeJsLink, allowing remote attackers to inject arbitrary web script or HTML via crafted javascr...

CVE-2024-25608

Summary: The CVE affects Liferay Portal and Liferay DXP versions as described in multiple sources. Root cause: HtmlUtil.escapeRedirect can be bypassed using the Replacement Character (U+FFFD), enabling redirection to arbitrary external URLs. Affected products and versions: Liferay Portal 7.2.0–7....

CVE-2024-26269

CVE-2024-26269 is an XSS vulnerability in the Frontend JS module’s portlet.js affecting Liferay Portal 7.2.0–7.4.3.37 and Liferay DXP 7.4 (pre-38), 7.3 (pre-11), 7.2 (pre-fix pack 20), including older unsupported versions. The flaw allows remote attackers to inject arbitrary web script via the UR...

CVE-2022-26593

CVE-2022-26593 is an XSS vulnerability affecting Liferay Portal/DXP: Asset module’s asset categories selector in Liferay Portal 7.3.3–7.4.0 and Liferay DXP 7.3 before SP3. The issue allows remote attackers to inject arbitrary web script/HTML via the name of an asset category. Root cause is a cros...

CVE-2024-25152

CVE-2024-25152 affects Liferay Portal 7.2.0–7.4.2 and Liferay DXP 7.3 (before SP3) / 7.2 (before FP17) and older unsupported versions. The vulnerability is a stored XSS in the Message Board widget triggered via the filename of an attachment, allowing remote authenticated users to inject arbitrary...

CVE-2024-25603

The CVE-2024-25603 issue affects Liferay Portal and Liferay DXP where a stored XSS flaw exists in the Dynamic Data Mapping (DDMForm) component. The vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter. Affected versions include Portal...

CVE-2024-26266

CVE-2024-26266 corresponds to multiple stored XSS vulnerabilities in Liferay Portal and Liferay DXP. Affected products/versions include Liferay Portal 7.2.0 through 7.4.3.13, and DXP releases prior to certain fixes, where remote authenticated users can inject arbitrary script/HTML via crafted pay...

CVE-2024-25145

CVE-2024-25145 describes a stored cross-site scripting (XSS) vulnerability in the Portal Search module’s Search Result app of Liferay Portal 7.2.0–7.4.3.11, and older unsupported versions, plus certain Liferay DXP builds. The issue allows remote authenticated users to inject arbitrary script/HTML...

CVE-2024-25609

CVE-2024-25609 affects Liferay Portal 7.2.0–7.4.3.12 and Liferay DXP 7.4 before update 9, 7.3 SP3, 7.2 FP15–FP18, and older unsupported versions. The issue is a bypass of HtmlUtil.escapeRedirect caused by an incomplete fix from CVE-2022-28977, enabling remote attackers to redirect users to arbitr...

CVE-2024-26265

CVE-2024-26265 affects the Image Uploader module in Liferay Portal (7.2.0–7.4.3.15 and older unsupported) and Liferay DXP (7.4 pre-update 16, 7.3 pre-update 4, 7.2 pre-fix pack 19). The root cause is reliance on a request parameter to cap upload size; remote authenticated users can modify the max...

CVE-2024-25601

CVE-2024-25601 affects the Expando module geolocation custom fields in Liferay Portal 7.2.0–7.4.2 and older unsupported versions, and Liferay DXP 7.3 before SP3, 7.2 before FP17. It is a stored XSS vulnerability allowing remote authenticated users to inject arbitrary web script or HTML via the na...

CVE-2024-25151

CVE-2024-25151 affects Liferay Portal 7.2.0–7.4.2 and Liferay DXP 7.3 before SP3, 7.2 before FP15, and older versions. The Calendar module does not escape user-supplied data in the default notification email template, enabling remote authenticated users to inject script/HTML via the calendar even...

CVE-2024-26268

The CVE-2024-26268 issue is a user enumeration vulnerability in Liferay Portal (7.2.0–7.4.3.26) and older unsupported versions, and in Liferay DXP 7.4 before update 27, 7.3 before update 8, and 7.2 before fix pack 20. The root cause is that an attacker can infer whether an account exists by measu...

CVE-2024-25607

The CVE-2024-25607 entry affects Liferay Portal 7.2.0–7.4.3.15 and older unsupported versions, and Liferay DXP shown to use PBKDF2-HMAC-SHA1 with a low work factor. This weak default hashing enables attackers to crack password hashes more quickly, posing confidentiality risk. Affected components ...

CVE-2024-25149

CVE-2024-25149 affects Liferay Portal 7.2.0–7.4.1 and Liferay DXP 7.3 before SP3 (and older/unsupported versions), where the policy to limit membership to the parent site does not properly restrict membership in a child site. This enables remote authenticated users to add non-members of the paren...

CVE-2024-25610

CVE-2024-25610 affects Liferay Portal 7.2.0–7.4.3.12 and Liferay DXP 7.2–7.4 with specific updates. The root cause is a default configuration that does not sanitize JavaScript in blog content, allowing remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload i...

CVE-2024-26267

CVE-2024-26267 affects Liferay Portal 7.2.0–7.4.3.25 and older unsupported versions, plus Liferay DXP 7.4 before update 26, 7.3 before update 5, and 7.2 before fix pack 19. The root cause is the portal property http.header.version.verbosity defaulting to full, enabling remote attackers to identif...

CVE-2022-42112

The CVE-2022-42112 vulnerability is an XSS issue in the Portal Search module’s Sort widget affecting Liferay Portal 7.2.0–7.4.3.24 and Liferay DXP 7.2 (pre fix pack 19), 7.3 (pre update 5), and 7.4 (pre update 25). The root cause is a crafted payload that allows remote attackers to inject arbitra...

CVE-2024-25150

Information Disclosure in Liferay Portal/DXP: CVE-2024-25150 affects Liferay Portal 7.2.0–7.4.2 (and related DXP/vintage releases) where remote authenticated users can enumerate user screen names and obtain a user’s full name from the page title. Root cause relates to enumeration via the Control ...

CVE-2023-47798

CVE-2023-47798 affects Liferay Portal 7.2.0–7.3.0 and older unsupported versions, and Liferay DXP 7.2 before fix pack 5. The issue is that account lockout does not invalidate existing user sessions, allowing remote authenticated users to remain authenticated after lockout. Root cause: session per...

CVE-2024-25606

XXE vulnerability in Liferay Portal and Liferay DXP tracked as CVE-2024-25606 affects multiple versions (Liferay Portal 7.2.0–7.4.3.7; DXP 7.2/7.3/7.4 with specific updates). The underlying issue is in the Java2WsddTask._format method, allowing an attacker with permission to deploy widgets/portle...

CVE-2024-25143

CVE-2024-25143 affects Liferay Portal 7.2.0–7.3.6 and Liferay DXP 7.3 before SP3, and 7.2 before FP13; the issue arises when generating previews for Document and Media widgets, where resource consumption is not limited, leading to possible DoS via crafted PNG images. Exploitation status is not de...

CVE-2025-43816

CVE-2025-43816 describes a memory leak in the headless API for StructuredContents of Liferay Portal/DXP. Affected: Liferay Portal 7.4.0–7.4.3.119; Liferay Portal 7.4 GA up to update 92; Liferay DXP 2024.Q1.1–2024.Q1.5, 2023.Q4.0–2024.Q4.10, 2023.Q3.1–2023.Q3.10; related unsupported/older versions...

CVE-2025-43792

CVE-2025-43792 affects Liferay Portal 7.4.0–7.4.3.105 and older unsupported versions, and Liferay DXP 2023.Q4.0/2023.Q3.x, where the live-site remote address is not reliably obtained from the database. This allows remote authenticated users to exfiltrate data to an attacker-controlled server via ...

CVE-2025-43793

CVE-2025-43793 affects Liferay Portal (7.4.0–7.4.3.105) and Liferay DXP (2023.Q4.0, 2023.Q3.1–2023.Q3.4, 7.4 GA–update 92, 7.3 GA–update 35). The issue is improper subdomain/domain subcomponent identification that can create a supercookie, enabling remote attackers controlling a website sharing t...

CVE-2025-43795

CVE-2025-43795: Open redirect vulnerabilities in Liferay Portal/DXP SystemSettingsPortlet, InstanceSettingsPortlet and SiteSettingsPortlet redirects (com_liferay_configuration_admin_web_portlet *_redirect). Affected: Liferay Portal 7.1.0–7.4.3.101; Liferay DXP 2023.Q3.1–2023.Q3.4; 7.4 GA up to up...

CVE-2025-43797

CVE-2025-43797 (Liferay) affects Liferay Portal 7.1.0–7.4.3.111 and Liferay DXP 2023.Q4.0, 2023.Q3.1–2023.Q3.4, plus older unsupported builds. The root cause is a default Open membership setting on newly created sites, which allows any registered user to become a member and potentially view, add,...

CVE-2025-43813

Summary (CVE-2025-43813) : Liferay Portal (ComboServlet) is vulnerable to path traversal in affected versions (Portal 7.4.0–7.4.3.107, older unsupported; Liferay DXP 2023.Q3/Q4 series; related 7.4/7.3 GA updates). The flaw allows remote attackers to access arbitrary CSS/JS files and load them rep...

CVE-2025-62250

CVE-2025-62250 describes an Improper Authentication flaw in Liferay Portal/DXP where remote attackers can send unauthenticated cluster messages that are treated as trusted data. Affected products include Liferay Portal 7.4.0 through 7.4.3.132 and older unsupported versions, and Liferay DXP 2023.Q...

CVE-2025-62255

The CVE-2025-62255 entry describes a Self Cross-site Scripting (XSS) vulnerability in Liferay Portal 7.4.0–7.4.3.101 and Liferay DXP 2023.Q3.1–2023.Q3.5, plus 7.4 GA through update 92 and older unsupported versions. The root cause is improper handling of crafted payloads in an attachment filename...

CVE-2025-43799

CVE-2025-43799 affects Liferay Portal 7.4.0–7.4.3.111 (and older unsupported versions) and Liferay DXP 2023.Q4.0, 2023.Q3.1–3.4, 7.4 GA up to update 92, and 7.3 GA up to update 35. The issue: APIs may be accessible before a user changes their initial password, allowing remote users to access and ...

CVE-2025-62253

Open Redirect in Liferay Portal/DXP: The issue arises from mishandling the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter, allowing remote attackers to redirect users to arbitrary external URLs in affected versions (Liferay Portal 7.4.0–7.4.3.97 and Liferay DXP 2023.Q4...

CVE-2025-43801

An XML-RPC input validation issue in Liferay Portal/dxP: Unchecked input for loop condition affects com.liferay.portal.impl in Liferay Portal 7.4.0–7.4.3.111 and Liferay DXP 2023.Q4.0, 2023.Q3.1–2023.Q3.4, 7.4 GA–update 92, 7.3 GA–update 35, enabling DoS via crafted XML-RPC requests. Affected pac...

CVE-2025-43794

Affected products/versions: Liferay Portal 7.4.0–7.4.3.111 and older unsupported releases; Liferay DXP 2023.Q3.1–2023.Q3.4, 2023.Q4.0, 7.4 GA–update 92, 7.3 GA–update 35. Vulnerability: Stored cross-site scripting (XSS) via the Instance Configuration’s (1) CDN Host HTTP field or (2) CDN Host HTTP...