# com.liferay.portal:com.liferay.portal.impl (Maven) vulnerabilities 18 known vulnerabilities (1 high, 12 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://central.sonatype.com/artifact/com.liferay.portal/com.liferay.portal.impl ## Advisories (18) ### [CVE-2025-62276](https://cve.now/CVE-2025-62276): The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay… - Severity: Medium 4.6 - Published: Oct 31, 2025 - Affected: fixed in 69.1.0. ### [CVE-2025-62261](https://cve.now/CVE-2025-62261): Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update… - Severity: Medium 6.9 - Published: Oct 27, 2025 - Affected: fixed in 92.0.2. ### [CVE-2025-62254](https://cve.now/CVE-2025-62254): The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2… - Severity: Medium 6.9 - Published: Oct 23, 2025 - Affected: fixed in 97.0.0. ### [CVE-2025-62249](https://cve.now/CVE-2025-62249): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through… - Severity: Medium 6.9 - Published: Oct 21, 2025 - Affected: through 114.1.0. ### [CVE-2025-62252](https://cve.now/CVE-2025-62252): Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and… - Severity: Medium 5.3 - Published: Oct 13, 2025 - Affected: fixed in 99.0.0. ### [CVE-2025-43813](https://cve.now/CVE-2025-43813): Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older… - Severity: Medium 6.9 - Published: Sep 29, 2025 - Affected: fixed in 96.0.0. ### [CVE-2025-43809](https://cve.now/CVE-2025-43809): Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and… - Severity: Medium 5.1 - Published: Sep 19, 2025 - Affected: fixed in 101.0.0. ### [CVE-2025-43801](https://cve.now/CVE-2025-43801): Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and… - Severity: Medium 6.9 - Published: Sep 16, 2025 - Affected: fixed in 101.0.0. ### [CVE-2025-43793](https://cve.now/CVE-2025-43793): Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA… - Severity: Medium 6.9 - Published: Sep 15, 2025 - Affected: fixed in 96.0.0. ### [CVE-2025-43794](https://cve.now/CVE-2025-43794): Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP… - Severity: Medium 4.6 - Published: Sep 15, 2025 - Affected: fixed in 99.0.0. ### [CVE-2025-43768](https://cve.now/CVE-2025-43768): Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through… - Severity: Medium 5.1 - Published: Aug 23, 2025 - Affected: fixed in 108.1.1. ### [CVE-2025-43735](https://cve.now/CVE-2025-43735): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through… - Severity: Medium 6.9 - Published: Aug 12, 2025 - Affected: from 7.0.4, fixed in 109.1.0. ### [CVE-2021-29050](https://cve.now/CVE-2021-29050): Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in Liferay Portal before 7.3.6, and Liferay DXP 7.3 before… - Severity: High 8.8 - Published: Feb 20, 2024 - Affected: fixed in 5.25.0. ### [CVE-2022-41414](https://cve.now/CVE-2022-41414): An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate… - Severity: Unrated - Published: Oct 7, 2022 - Affected: fixed in 8.0.0. ### [CVE-2022-26595](https://cve.now/CVE-2022-26595): Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when… - Severity: Unrated - Published: Apr 19, 2022 - Affected: fixed in 7.7.9. ### [CVE-2021-33322](https://cve.now/CVE-2021-33322): In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password… - Severity: Unrated - Published: Aug 3, 2021 - Affected: fixed in 5.7.3. ### [CVE-2021-33321](https://cve.now/CVE-2021-33321): Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate… - Severity: Unrated - Published: Aug 3, 2021 - Affected: fixed in 5.11.0. ### [CVE-2020-15840](https://cve.now/CVE-2020-15840): In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property… - Severity: Unrated - Published: Sep 24, 2020 - Affected: from 7.2.0, fixed in 7.4.0; fixed in 7.1.3. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/com.liferay.portal:com.liferay.portal.impl Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.