- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 18 · 1 high, 12 medium
- Registry
- Maven Central
Advisories 18
- CVE-2025-62276Medium 4.6
The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay…
Affected: fixed in 69.1.0.
- CVE-2025-62261Medium 6.9
Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update…
Affected: fixed in 92.0.2.
- CVE-2025-62254Medium 6.9
The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2…
Affected: fixed in 97.0.0.
- CVE-2025-62249Medium 6.9
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through…
Affected: through 114.1.0.
- CVE-2025-62252Medium 5.3
Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and…
Affected: fixed in 99.0.0.
- CVE-2025-43813Medium 6.9
Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older…
Affected: fixed in 96.0.0.
- CVE-2025-43809Medium 5.1
Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and…
Affected: fixed in 101.0.0.
- CVE-2025-43801Medium 6.9
Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and…
Affected: fixed in 101.0.0.
- CVE-2025-43793Medium 6.9
Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA…
Affected: fixed in 96.0.0.
- CVE-2025-43794Medium 4.6
Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP…
Affected: fixed in 99.0.0.
- CVE-2025-43768Medium 5.1
Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through…
Affected: fixed in 108.1.1.
- CVE-2025-43735Medium 6.9
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through…
Affected: from 7.0.4, fixed in 109.1.0.
- CVE-2021-29050High 8.8
Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in Liferay Portal before 7.3.6, and Liferay DXP 7.3 before…
Affected: fixed in 5.25.0.
- CVE-2022-41414Unrated
An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate…
Affected: fixed in 8.0.0.
- CVE-2022-26595Unrated
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when…
Affected: fixed in 7.7.9.
Show all 18 advisoriesShow fewer advisories
- CVE-2021-33322Unrated
In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password…
Affected: fixed in 5.7.3.
- CVE-2021-33321Unrated
Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate…
Affected: fixed in 5.11.0.
- CVE-2020-15840Unrated
In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property…
Affected: from 7.2.0, fixed in 7.4.0; fixed in 7.1.3.