# com.liferay.portal:release.portal.bom (Maven) vulnerabilities

159 known vulnerabilities (17 critical, 14 high, 82 medium, 3 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/com.liferay.portal/release.portal.bom

## Advisories (159)

### [CVE-2025-62264](https://cve.now/CVE-2025-62264): Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP…

- Severity: Medium 5.1
- Published: Oct 31, 2025
- Affected: from 7.4.3.8, fixed in 7.4.3.112-ga112.

### [CVE-2025-62265](https://cve.now/CVE-2025-62265): Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions…

- Severity: Medium 4.8
- Published: Oct 30, 2025
- Affected: from 7.4.0-ga1, fixed in 7.4.3.112-ga112.

### [CVE-2025-62266](https://cve.now/CVE-2025-62266): By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0…

- Severity: Medium 5.1
- Published: Oct 30, 2025
- Affected: from 7.4.0-ga1, fixed in 7.4.3.110.

### [CVE-2025-62257](https://cve.now/CVE-2025-62257): Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1…

- Severity: Medium 6.3
- Published: Oct 29, 2025
- Affected: from 7.4.0-ga1, fixed in 7.4.3.120.

### [CVE-2025-62258](https://cve.now/CVE-2025-62258): CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through…

- Severity: High 7.0
- Published: Oct 27, 2025
- Affected: from 7.4.0-ga1, fixed in 7.4.3.108.

### [CVE-2025-62259](https://cve.now/CVE-2025-62259): Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update…

- Severity: Medium 6.9
- Published: Oct 27, 2025
- Affected: from 7.4.0-ga1, fixed in 7.4.3.110.

### [CVE-2025-62260](https://cve.now/CVE-2025-62260): Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35…

- Severity: High 7.1
- Published: Oct 27, 2025
- Affected: from 7.4.0-ga1, fixed in 7.4.3.100.

### [CVE-2025-62261](https://cve.now/CVE-2025-62261): Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update…

- Severity: Medium 6.9
- Published: Oct 27, 2025
- Affected: from 7.4.0-ga1, fixed in 7.4.3.100.

### [CVE-2025-43830](https://cve.now/CVE-2025-43830): Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through…

- Severity: Medium 5.1
- Published: Oct 8, 2025
- Affected: from 7.3.2, fixed in 7.4.3.112-ga112.

### [CVE-2025-43822](https://cve.now/CVE-2025-43822): Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through…

- Severity: Medium 4.8
- Published: Oct 7, 2025
- Affected: from 7.4.3.15, fixed in 7.4.3.112-ga112.

### [CVE-2025-43823](https://cve.now/CVE-2025-43823): Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP…

- Severity: Medium 4.8
- Published: Oct 7, 2025
- Affected: from 7.4.0, fixed in 7.4.3.112-ga112.

### [CVE-2025-43824](https://cve.now/CVE-2025-43824): The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5…

- Severity: Medium 4.8
- Published: Oct 6, 2025
- Affected: from 7.4.0-ga1, fixed in 7.4.3.112-ga112.

### [CVE-2025-43826](https://cve.now/CVE-2025-43826): Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older…

- Severity: Medium 4.8
- Published: Sep 30, 2025
- Affected: from 7.4.0-ga1, fixed in 7.4.3.113-ga113.

### [CVE-2025-43817](https://cve.now/CVE-2025-43817): Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0…

- Severity: Medium 4.8
- Published: Sep 29, 2025
- Affected: from 7.4.3.74-ga74, fixed in 7.4.3.112-ga112.

### [CVE-2025-43813](https://cve.now/CVE-2025-43813): Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older…

- Severity: Medium 6.9
- Published: Sep 29, 2025
- Affected: from 7.4.0-ga1, fixed in 7.4.3.108-ga108.

### [CVE-2025-43812](https://cve.now/CVE-2025-43812): Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0…

- Severity: Medium 4.8
- Published: Sep 29, 2025
- Affected: from 7.4.3.4-ga4, fixed in 7.4.3.112-ga112.

### [CVE-2025-43820](https://cve.now/CVE-2025-43820): Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35…

- Severity: Medium 4.8
- Published: Sep 29, 2025
- Affected: from 7.4.3.35-ga35, fixed in 7.4.3.111-ga111.

### [CVE-2025-43799](https://cve.now/CVE-2025-43799): Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA…

- Severity: Medium 6.9
- Published: Sep 15, 2025
- Affected: from 7.4.0, fixed in 7.4.3.112.

### [CVE-2025-43785](https://cve.now/CVE-2025-43785): Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9…

- Severity: Medium 4.6
- Published: Sep 10, 2025
- Affected: from 7.4.3.45, fixed in 7.4.3.129.

### [CVE-2025-43776](https://cve.now/CVE-2025-43776): A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9…

- Severity: Medium 4.6
- Published: Sep 9, 2025
- Affected: from 7.4.0, through 7.4.3.132.

### [CVE-2025-43760](https://cve.now/CVE-2025-43760): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through…

- Severity: Medium 5.3
- Published: Aug 22, 2025
- Affected: from 7.4.0-ga1, through 7.4.3.132-ga132.

### [CVE-2025-43752](https://cve.now/CVE-2025-43752): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through…

- Severity: Medium 5.3
- Published: Aug 22, 2025
- Affected: from 7.4.0-ga1, through 7.4.3.132-ga132.

### [CVE-2025-43754](https://cve.now/CVE-2025-43754): Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0…

- Severity: Medium 6.9
- Published: Aug 21, 2025
- Affected: from 7.4.0-ga1, through 7.4.3.132-ga132.

### [CVE-2025-43756](https://cve.now/CVE-2025-43756): \<!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}--\>A reflected cross-site scripting (XSS) vulnerability in the…

- Severity: Medium 6.9
- Published: Aug 21, 2025
- Affected: versions 7.4.3.132-ga132.

### [CVE-2025-43757](https://cve.now/CVE-2025-43757): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through…

- Severity: Medium 4.8
- Published: Aug 20, 2025
- Affected: from 7.4.0-ga1, through 7.4.3.132-ga132.

### [CVE-2025-43746](https://cve.now/CVE-2025-43746): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through…

- Severity: Medium 5.1
- Published: Aug 20, 2025
- Affected: from 7.4.0-ga1, through 7.4.3.132-ga132.

### [CVE-2025-43748](https://cve.now/CVE-2025-43748): Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through…

- Severity: High 7.1
- Published: Aug 20, 2025
- Affected: from 7.0.0-a1, fixed in 7.4.3.120-ga120.

### [CVE-2025-43749](https://cve.now/CVE-2025-43749): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through…

- Severity: Medium 5.3
- Published: Aug 20, 2025
- Affected: from 7.4.0-ga1, through 7.4.3.132-ga132.

### [CVE-2025-43741](https://cve.now/CVE-2025-43741): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through…

- Severity: Medium 5.1
- Published: Aug 20, 2025
- Affected: from 7.4.0-ga1, through 7.4.3.132-ga132.

### [CVE-2025-43744](https://cve.now/CVE-2025-43744): A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through…

- Severity: Medium 5.1
- Published: Aug 19, 2025
- Affected: from 7.4.0-ga1, through 7.4.3.132-ga132.

### [CVE-2025-43743](https://cve.now/CVE-2025-43743): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through…

- Severity: Medium 5.3
- Published: Aug 19, 2025
- Affected: from 7.4.0-ga1, through 7.4.3.132-ga132.

### [CVE-2025-43745](https://cve.now/CVE-2025-43745): A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14…

- Severity: Medium 6.9
- Published: Aug 19, 2025
- Affected: from 7.4.0-ga1, through 7.4.3.132-ga132.

### [CVE-2025-43740](https://cve.now/CVE-2025-43740): A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through…

- Severity: Medium 4.6
- Published: Aug 19, 2025
- Affected: from 7.4.3.120-ga120, through 7.4.3.132-ga23.

### [CVE-2025-43731](https://cve.now/CVE-2025-43731): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through…

- Severity: Medium 6.9
- Published: Aug 18, 2025
- Affected: from 7.4.0-ga1, through 7.4.3.132-ga132.

### [CVE-2025-3639](https://cve.now/CVE-2025-3639): Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through…

- Severity: Low 2.0
- Published: Aug 18, 2025
- Affected: from 7.3.0-ga1, through 7.4.3.132-ga132.

### [CVE-2025-43734](https://cve.now/CVE-2025-43734): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through…

- Severity: Medium 5.1
- Published: Aug 12, 2025
- Affected: from 7.4.0, through 7.4.3.132.

### [CVE-2025-43735](https://cve.now/CVE-2025-43735): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through…

- Severity: Medium 6.9
- Published: Aug 12, 2025
- Affected: from 7.4.0, fixed in 7.4.3.132.

### [CVE-2025-43736](https://cve.now/CVE-2025-43736): A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through…

- Severity: Medium 6.9
- Published: Aug 12, 2025
- Affected: from 7.4.3.0, through 7.4.3.132.

### [CVE-2025-4655](https://cve.now/CVE-2025-4655): SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5…

- Severity: Medium 5.1
- Published: Aug 9, 2025
- Affected: from 7.4.0, through 7.4.3.132.

### [CVE-2025-4581](https://cve.now/CVE-2025-4581): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through…

- Severity: Medium 5.3
- Published: Aug 9, 2025
- Affected: from 7.4.0, through 7.4.3.132.

### [CVE-2025-3760](https://cve.now/CVE-2025-3760): A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129…

- Severity: Medium 4.8
- Published: Apr 17, 2025
- Affected: from 7.2.0, fixed in 7.4.3.132.

### [CVE-2025-2565](https://cve.now/CVE-2025-2565): The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12…

- Severity: Medium 5.1
- Published: Mar 20, 2025
- Affected: from 7.4.0, fixed in 7.4.3.129.

### [CVE-2025-2536](https://cve.now/CVE-2025-2536): Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through…

- Severity: Medium 5.1
- Published: Mar 19, 2025
- Affected: from 7.4.3.82, fixed in 7.4.3.129.

### [CVE-2023-37940](https://cve.now/CVE-2023-37940): Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP…

- Severity: Medium 4.8
- Published: Dec 17, 2024
- Affected: from 7.0.0, fixed in 7.4.3.88.

### [CVE-2024-11993](https://cve.now/CVE-2024-11993): Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38…

- Severity: Medium 4.6
- Published: Dec 17, 2024
- Affected: from 7.1.0, fixed in 7.4.3.39.

### [CVE-2024-38002](https://cve.now/CVE-2024-38002): The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through…

- Severity: Critical 9.0
- Published: Oct 22, 2024
- Affected: from 7.3.2-ga3, fixed in 7.4.3.112-ga112.

### [CVE-2024-26273](https://cve.now/CVE-2024-26273): Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP…

- Severity: High 8.8
- Published: Oct 22, 2024
- Affected: from 7.4.0, fixed in 7.4.3.104.

### [CVE-2024-26272](https://cve.now/CVE-2024-26272): Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP…

- Severity: High 8.8
- Published: Oct 22, 2024
- Affected: from 7.3.2, fixed in 7.4.3.108.

### [CVE-2024-8980](https://cve.now/CVE-2024-8980): The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3…

- Severity: Critical 9.6
- Published: Oct 22, 2024
- Affected: from 7.0.0-a1, fixed in 7.4.3.102-GA102.

### [CVE-2024-26271](https://cve.now/CVE-2024-26271): Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP…

- Severity: High 8.8
- Published: Oct 22, 2024
- Affected: from 7.4.3.75, fixed in 7.4.3.112.

### [CVE-2023-47795](https://cve.now/CVE-2023-47795): Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay…

- Severity: Critical 9.0
- Published: Feb 21, 2024
- Affected: from 7.4.3.18, fixed in 7.4.3.102.

### [CVE-2024-25151](https://cve.now/CVE-2024-25151): The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2…

- Severity: Medium 5.4
- Published: Feb 21, 2024
- Affected: fixed in 7.4.3.4.

### [CVE-2023-40191](https://cve.now/CVE-2023-40191): Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and…

- Severity: Critical 9.0
- Published: Feb 21, 2024
- Affected: from 7.4.3.44, fixed in 7.4.3.98.

### [CVE-2023-42498](https://cve.now/CVE-2023-42498): Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and…

- Severity: Critical 9.6
- Published: Feb 21, 2024
- Affected: from 7.4.3.8, fixed in 7.4.3.98.

### [CVE-2024-26269](https://cve.now/CVE-2024-26269): Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP…

- Severity: Critical 9.6
- Published: Feb 21, 2024
- Affected: from 7.2.0, fixed in 7.4.3.38.

### [CVE-2024-26266](https://cve.now/CVE-2024-26266): Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and…

- Severity: Critical 9.0
- Published: Feb 21, 2024
- Affected: fixed in 7.4.3.14.

### [CVE-2023-42496](https://cve.now/CVE-2023-42496): Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and…

- Severity: Critical 9.6
- Published: Feb 21, 2024
- Affected: from 7.3.3, fixed in 7.4.3.98.

### [CVE-2024-25603](https://cve.now/CVE-2024-25603): Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and…

- Severity: Critical 9.0
- Published: Feb 21, 2024
- Affected: fixed in 7.4.3.5.

### [CVE-2024-25152](https://cve.now/CVE-2024-25152): Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported…

- Severity: Critical 9.0
- Published: Feb 21, 2024
- Affected: through 7.4.2.

### [CVE-2024-25601](https://cve.now/CVE-2024-25601): Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and…

- Severity: Critical 9.0
- Published: Feb 21, 2024
- Affected: through 7.4.2.

### [CVE-2024-25602](https://cve.now/CVE-2024-25602): Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older…

- Severity: Critical 9.0
- Published: Feb 21, 2024
- Affected: through 7.4.2.

### [CVE-2024-25147](https://cve.now/CVE-2024-25147): Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions…

- Severity: Critical 9.6
- Published: Feb 21, 2024
- Affected: through 7.4.1.

### [CVE-2024-26270](https://cve.now/CVE-2024-26270): The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through…

- Severity: Medium 6.5
- Published: Feb 20, 2024
- Affected: from 7.4.3.76, fixed in 7.4.3.100.

### [CVE-2024-26268](https://cve.now/CVE-2024-26268): User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update…

- Severity: Medium 5.3
- Published: Feb 20, 2024
- Affected: from 7.2.0, fixed in 7.4.3.27-ga27.

### [CVE-2024-26267](https://cve.now/CVE-2024-26267): In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2…

- Severity: Medium 5.3
- Published: Feb 20, 2024
- Affected: from 7.2.0, fixed in 7.4.3.26-ga26.

### [CVE-2024-26265](https://cve.now/CVE-2024-26265): The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16…

- Severity: Medium 5.0
- Published: Feb 20, 2024
- Affected: fixed in 7.4.3.16.

### [CVE-2024-25610](https://cve.now/CVE-2024-25610): In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2…

- Severity: Critical 9.0
- Published: Feb 20, 2024
- Affected: fixed in 7.4.3.13.

### [CVE-2024-25609](https://cve.now/CVE-2024-25609): HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3…

- Severity: Medium 6.1
- Published: Feb 20, 2024
- Affected: from 7.2.0, fixed in 7.4.3.13-ga13.

### [CVE-2024-25608](https://cve.now/CVE-2024-25608): HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19…

- Severity: Medium 6.1
- Published: Feb 20, 2024
- Affected: from 7.2.0, fixed in 7.4.3.19-ga19.

### [CVE-2024-25607](https://cve.now/CVE-2024-25607): The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and…

- Severity: High 8.1
- Published: Feb 20, 2024
- Affected: fixed in 7.4.3.14.

### [CVE-2024-25606](https://cve.now/CVE-2024-25606): XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before…

- Severity: High 8.0
- Published: Feb 20, 2024
- Affected: fixed in 7.4.3.8.

### [CVE-2024-25605](https://cve.now/CVE-2024-25605): The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service…

- Severity: Medium 5.3
- Published: Feb 20, 2024
- Affected: from 7.2.0, fixed in 7.4.3.5-ga5.

### [CVE-2024-25604](https://cve.now/CVE-2024-25604): Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix…

- Severity: Medium 6.5
- Published: Feb 20, 2024
- Affected: from 7.2.0, fixed in 7.4.3.5-ga5.

### [CVE-2024-25150](https://cve.now/CVE-2024-25150): Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and…

- Severity: Medium 4.3
- Published: Feb 20, 2024
- Affected: from 7.2.0, fixed in 7.4.3.4-ga4.

### [CVE-2024-25149](https://cve.now/CVE-2024-25149): Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and…

- Severity: Medium 5.4
- Published: Feb 20, 2024
- Affected: from 7.2.0, fixed in 7.4.2-ga3.

### [CVE-2023-5190](https://cve.now/CVE-2023-5190): Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP…

- Severity: Medium 6.1
- Published: Feb 20, 2024
- Affected: from 7.4.3.45-ga45, fixed in 7.4.3.102-ga102.

### [CVE-2022-45320](https://cve.now/CVE-2022-45320): Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote…

- Severity: Medium 6.3
- Published: Feb 20, 2024
- Affected: fixed in 7.4.3.16.

### [CVE-2024-25148](https://cve.now/CVE-2024-25148): In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15…

- Severity: Medium 5.4
- Published: Feb 8, 2024
- Affected: from 7.2.0, fixed in 7.4.2.

### [CVE-2024-25146](https://cve.now/CVE-2024-25146): Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and…

- Severity: Medium 5.3
- Published: Feb 8, 2024
- Affected: from 7.2.0, fixed in 7.4.2.

### [CVE-2024-25144](https://cve.now/CVE-2024-25144): The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3…

- Severity: Medium 4.1
- Published: Feb 8, 2024
- Affected: from 7.2.0, fixed in 7.4.3.27.

### [CVE-2023-47798](https://cve.now/CVE-2023-47798): Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older…

- Severity: Medium 5.4
- Published: Feb 8, 2024
- Affected: from 7.2.0, fixed in 7.3.1.

### [CVE-2024-25145](https://cve.now/CVE-2024-25145): Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11…

- Severity: Critical 9.6
- Published: Feb 7, 2024
- Affected: fixed in 7.4.3.12.

### [CVE-2024-25143](https://cve.now/CVE-2024-25143): The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service…

- Severity: Medium 6.5
- Published: Feb 7, 2024
- Affected: from 7.2.0, fixed in 7.3.7.

### [CVE-2023-47797](https://cve.now/CVE-2023-47797): Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote…

- Severity: Critical 9.6
- Published: Nov 17, 2023
- Affected: from 7.4.3.94, fixed in 7.4.3.96.

### [CVE-2023-35030](https://cve.now/CVE-2023-35030): Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and…

- Severity: High 8.8
- Published: Jun 15, 2023
- Affected: from 7.4.3.70-ga70, fixed in 7.4.3.77-ga77.

### [CVE-2023-35029](https://cve.now/CVE-2023-35029): Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4…

- Severity: Medium 6.1
- Published: Jun 15, 2023
- Affected: from 7.4.3.70-ga70, fixed in 7.4.3.77-ga77.

### [CVE-2023-3193](https://cve.now/CVE-2023-3193): Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay…

- Severity: Medium 6.1
- Published: Jun 15, 2023
- Affected: from 7.4.3.70-ga70, fixed in 7.4.3.74-ga74.

### [CVE-2023-33950](https://cve.now/CVE-2023-33950): Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that…

- Severity: Medium 6.5
- Published: May 24, 2023
- Affected: from 7.4.3.48, fixed in 7.4.3.77.

### [CVE-2023-33949](https://cve.now/CVE-2023-33949): In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their…

- Severity: Medium 5.3
- Published: May 24, 2023
- Affected: from 7.0.0, fixed in 7.3.1.

### [CVE-2023-33948](https://cve.now/CVE-2023-33948): The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which…

- Severity: Medium 5.3
- Published: May 24, 2023
- Affected: from 7.4.3.67, fixed in 7.4.3.68.

### [CVE-2023-33947](https://cve.now/CVE-2023-33947): The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by…

- Severity: Low 2.7
- Published: May 24, 2023
- Affected: from 7.4.3.4, fixed in 7.4.3.61.

### [CVE-2023-33946](https://cve.now/CVE-2023-33946): The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in…

- Severity: Low 2.7
- Published: May 24, 2023
- Affected: from 7.4.3.4, fixed in 7.4.3.49.

### [CVE-2023-33945](https://cve.now/CVE-2023-33945): SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before…

- Severity: Medium 6.4
- Published: May 24, 2023
- Affected: from 7.3.1, fixed in 7.4.3.18.

### [CVE-2023-33944](https://cve.now/CVE-2023-33944): Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24…

- Severity: Medium 4.8
- Published: May 24, 2023
- Affected: from 7.3.4, fixed in 7.4.3.69.

### [CVE-2023-33943](https://cve.now/CVE-2023-33943): Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21…

- Severity: Medium 5.4
- Published: May 24, 2023
- Affected: from 7.4.3.21, fixed in 7.4.3.63.

### [CVE-2023-33942](https://cve.now/CVE-2023-33942): Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and…

- Severity: Medium 5.4
- Published: May 24, 2023
- Affected: from 7.4.3.50, fixed in 7.4.3.51.

### [CVE-2023-33941](https://cve.now/CVE-2023-33941): Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in…

- Severity: Medium 6.1
- Published: May 24, 2023
- Affected: from 7.4.3.41, fixed in 7.4.3.53.

### [CVE-2023-33940](https://cve.now/CVE-2023-33940): Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before…

- Severity: Medium 4.8
- Published: May 24, 2023
- Affected: from 7.4.0, fixed in 7.4.3.31.

### [CVE-2023-33939](https://cve.now/CVE-2023-33939): Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before…

- Severity: Medium 5.4
- Published: May 24, 2023
- Affected: from 7.1.0, fixed in 7.4.3.13.

### [CVE-2023-33938](https://cve.now/CVE-2023-33938): Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and…

- Severity: Medium 4.8
- Published: May 24, 2023
- Affected: from 7.3.0, fixed in 7.4.1.

### [CVE-2023-33937](https://cve.now/CVE-2023-33937): Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1…

- Severity: Medium 5.4
- Published: May 24, 2023
- Affected: from 7.1.0, fixed in 7.3.1.

### [CVE-2022-42132](https://cve.now/CVE-2022-42132): The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix…

- Severity: Medium 5.9
- Published: Nov 15, 2022
- Affected: from 7.0.0, fixed in 7.4.3.5-ga5.

### [CVE-2022-42131](https://cve.now/CVE-2022-42131): Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers.

- Severity: Medium 4.8
- Published: Nov 15, 2022
- Affected: from 7.1.0, fixed in 7.4.3.4.

### [CVE-2022-42130](https://cve.now/CVE-2022-42130): The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19…

- Severity: Medium 4.3
- Published: Nov 15, 2022
- Affected: from 7.1.0, fixed in 7.4.3.5.

### [CVE-2022-42129](https://cve.now/CVE-2022-42129): An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and…

- Severity: Medium 4.3
- Published: Nov 15, 2022
- Affected: from 7.3.2, fixed in 7.4.3.5.

### [CVE-2022-42128](https://cve.now/CVE-2022-42128): The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which…

- Severity: Medium 5.3
- Published: Nov 15, 2022
- Affected: from 7.4.1, fixed in 7.4.3.5.

### [CVE-2022-42127](https://cve.now/CVE-2022-42127): The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user…

- Severity: Medium 5.3
- Published: Nov 15, 2022
- Affected: from 7.4.3.5, fixed in 7.4.3.48.

### [CVE-2022-42126](https://cve.now/CVE-2022-42126): The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29…

- Severity: Medium 4.3
- Published: Nov 15, 2022
- Affected: from 7.3.5, fixed in 7.4.3.48.

### [CVE-2022-42125](https://cve.now/CVE-2022-42125): Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows…

- Severity: High 7.5
- Published: Nov 15, 2022
- Affected: from 7.4.3.5, fixed in 7.4.3.48.

### [CVE-2022-42124](https://cve.now/CVE-2022-42124): ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9…

- Severity: High 7.5
- Published: Nov 15, 2022
- Affected: from 7.3.2, fixed in 7.4.3.5.

### [CVE-2022-42123](https://cve.now/CVE-2022-42123): A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and…

- Severity: High 7.5
- Published: Nov 15, 2022
- Affected: from 7.3.3, fixed in 7.4.3.19.

### [CVE-2022-42122](https://cve.now/CVE-2022-42122): A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows…

- Severity: Critical 9.8
- Published: Nov 15, 2022
- Affected: from 7.3.7, fixed in 7.4.0-ga1.

### [CVE-2022-41414](https://cve.now/CVE-2022-41414): An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate…

- Severity: Unrated
- Published: Oct 7, 2022
- Affected: from 7.0.0-a1, fixed in 7.4.2-ga3.

### [CVE-2022-28977](https://cve.now/CVE-2022-28977): HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25…

- Severity: Medium 6.1
- Published: Sep 22, 2022
- Affected: from 7.3.1-ga2, fixed in 7.4.3.4-ga4.

### [CVE-2022-39975](https://cve.now/CVE-2022-39975): The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not…

- Severity: Medium 4.3
- Published: Sep 21, 2022
- Affected: from 7.3.3, fixed in 7.4.3.35.

### [CVE-2022-26595](https://cve.now/CVE-2022-26595): Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when…

- Severity: Unrated
- Published: Apr 19, 2022
- Affected: versions 7.3.7; from 7.4.0, fixed in 7.4.2-ga3.

### [CVE-2021-38267](https://cve.now/CVE-2021-38267): Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP…

- Severity: Unrated
- Published: Mar 2, 2022
- Affected: from 7.3.2, fixed in 7.3.7-ga8.

### [CVE-2021-35463](https://cve.now/CVE-2021-35463): Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary…

- Severity: Unrated
- Published: Aug 4, 2021
- Affected: from 7.4.0, fixed in 7.4.1.

### [CVE-2021-33338](https://cve.now/CVE-2021-33338): The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the…

- Severity: Unrated
- Published: Aug 4, 2021
- Affected: from 7.1.0, fixed in 7.3.3.

### [CVE-2021-33336](https://cve.now/CVE-2021-33336): Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP…

- Severity: Unrated
- Published: Aug 4, 2021
- Affected: from 7.3.0, fixed in 7.3.4.

### [CVE-2021-33339](https://cve.now/CVE-2021-33339): Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack…

- Severity: Unrated
- Published: Aug 4, 2021
- Affected: from 7.2.1, fixed in 7.3.5.

### [CVE-2021-33335](https://cve.now/CVE-2021-33335): Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack…

- Severity: Unrated
- Published: Aug 3, 2021
- Affected: from 7.0.3, fixed in 7.3.5.

### [CVE-2021-33332](https://cve.now/CVE-2021-33332): Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1…

- Severity: Unrated
- Published: Aug 3, 2021
- Affected: from 7.1.0, through 7.3.2.

### [CVE-2021-33334](https://cve.now/CVE-2021-33334): The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and…

- Severity: Unrated
- Published: Aug 3, 2021
- Affected: from 7.0.0, through 7.3.2.

### [CVE-2021-33333](https://cve.now/CVE-2021-33333): The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2…

- Severity: Unrated
- Published: Aug 3, 2021
- Affected: through 7.3.2.

### [CVE-2021-33331](https://cve.now/CVE-2021-33331): Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1…

- Severity: Unrated
- Published: Aug 3, 2021
- Affected: from 7.0.0, through 7.3.1.

### [CVE-2021-33330](https://cve.now/CVE-2021-33330): Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected…

- Severity: Unrated
- Published: Aug 3, 2021
- Affected: from 7.2.0, fixed in 7.3.3.

### [CVE-2021-33328](https://cve.now/CVE-2021-33328): Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP…

- Severity: Unrated
- Published: Aug 3, 2021
- Affected: from 7.0.0, through 7.3.4.

### [CVE-2021-33325](https://cve.now/CVE-2021-33325): The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2…

- Severity: Unrated
- Published: Aug 3, 2021
- Affected: from 7.3.0, through 7.3.2.

### [CVE-2021-33324](https://cve.now/CVE-2021-33324): The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not…

- Severity: Unrated
- Published: Aug 3, 2021
- Affected: from 7.1.0, fixed in 7.3.2.

### [CVE-2021-33321](https://cve.now/CVE-2021-33321): Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate…

- Severity: Unrated
- Published: Aug 3, 2021
- Affected: fixed in 7.3.3.

### [CVE-2021-29052](https://cve.now/CVE-2021-29052): The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in…

- Severity: Unrated
- Published: May 17, 2021
- Affected: from 7.3.0, through 7.3.5.

### [CVE-2021-29048](https://cve.now/CVE-2021-29048): Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP…

- Severity: Unrated
- Published: May 17, 2021
- Affected: from 7.3.4, fixed in 7.3.6.

### [CVE-2021-29051](https://cve.now/CVE-2021-29051): Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP…

- Severity: Unrated
- Published: May 17, 2021
- Affected: from 7.2.1, fixed in 7.3.6.

### [CVE-2021-29044](https://cve.now/CVE-2021-29044): Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through…

- Severity: Unrated
- Published: May 17, 2021
- Affected: from 7.0.0, fixed in 7.3.6.

### [CVE-2021-29043](https://cve.now/CVE-2021-29043): The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before…

- Severity: Unrated
- Published: May 17, 2021
- Affected: from 7.0.0, fixed in 7.3.6.

### [CVE-2021-29053](https://cve.now/CVE-2021-29053): Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to…

- Severity: Unrated
- Published: May 17, 2021
- Affected: from 7.3.5, fixed in 7.3.6.

### [CVE-2021-29046](https://cve.now/CVE-2021-29046): Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3…

- Severity: Unrated
- Published: May 17, 2021
- Affected: versions 7.3.5.

### [CVE-2021-29045](https://cve.now/CVE-2021-29045): Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5…

- Severity: Unrated
- Published: May 17, 2021
- Affected: from 7.3.2, through 7.3.5.

### [CVE-2021-29047](https://cve.now/CVE-2021-29047): The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers…

- Severity: Unrated
- Published: May 16, 2021
- Affected: from 7.3.4, fixed in 7.3.6.

### [CVE-2021-29040](https://cve.now/CVE-2021-29040): The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before…

- Severity: Unrated
- Published: May 16, 2021
- Affected: fixed in 7.3.5.

### [CVE-2021-29039](https://cve.now/CVE-2021-29039): Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote…

- Severity: Unrated
- Published: May 16, 2021
- Affected: from 7.3.4, fixed in 7.3.5.

### [CVE-2020-25476](https://cve.now/CVE-2020-25476): Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to…

- Severity: Unrated
- Published: Jan 7, 2021
- Affected: through 7.1.3; from 7.2, through 7.2.1.

### [CVE-2020-15840](https://cve.now/CVE-2020-15840): In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property…

- Severity: Unrated
- Published: Sep 24, 2020
- Affected: fixed in 7.3.1.

### [CVE-2020-24554](https://cve.now/CVE-2020-24554): The redirect module in Liferay Portal before 7.3.3 does not limit the number of URLs resulting in a 404 error that is recorded, which…

- Severity: Unrated
- Published: Sep 1, 2020
- Affected: fixed in 7.3.3.

### [CVE-2020-15842](https://cve.now/CVE-2020-15842): Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows…

- Severity: High 8.1
- Published: Jul 20, 2020
- Affected: fixed in 7.3.0.

### [CVE-2020-15841](https://cve.now/CVE-2020-15841): Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely…

- Severity: High 8.3
- Published: Jul 20, 2020
- Affected: fixed in 7.3.0.

### [CVE-2020-13444](https://cve.now/CVE-2020-13444): Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not…

- Severity: Unrated
- Published: Jun 10, 2020
- Affected: from 7.0.0, fixed in 7.3.2.

### [CVE-2020-13445](https://cve.now/CVE-2020-13445): In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API…

- Severity: Unrated
- Published: Jun 10, 2020
- Affected: fixed in 7.3.2.

### [CVE-2020-7934](https://cve.now/CVE-2020-7934): In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are…

- Severity: Unrated
- Published: Jan 28, 2020
- Affected: from 7.1.0, fixed in 7.3.0.

### [CVE-2019-16891](https://cve.now/CVE-2019-16891): Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.

- Severity: Unrated
- Published: Oct 4, 2019
- Affected: fixed in 7.1.1.

### [CVE-2019-6588](https://cve.now/CVE-2019-6588): In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into…

- Severity: Unrated
- Published: Jun 3, 2019
- Affected: fixed in 7.1.0.

### [CVE-2017-1000425](https://cve.now/CVE-2017-1000425): Cross-site scripting (XSS) vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers…

- Severity: Unrated
- Published: Jan 2, 2018
- Affected: fixed in 7.1.0-a1.

### [CVE-2017-12649](https://cve.now/CVE-2017-12649): XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display.

- Severity: Unrated
- Published: Aug 7, 2017
- Affected: fixed in 7.0.3-ga4.

### [CVE-2017-12648](https://cve.now/CVE-2017-12648): XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL.

- Severity: Unrated
- Published: Aug 7, 2017
- Affected: fixed in 7.0.3-GA4.

### [CVE-2017-12647](https://cve.now/CVE-2017-12647): XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title.

- Severity: Unrated
- Published: Aug 7, 2017
- Affected: fixed in 7.0.3-ga4.

### [CVE-2017-12646](https://cve.now/CVE-2017-12646): XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address.

- Severity: Unrated
- Published: Aug 7, 2017
- Affected: fixed in 7.0.3-GA4.

### [CVE-2017-12645](https://cve.now/CVE-2017-12645): XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.

- Severity: Unrated
- Published: Aug 7, 2017
- Affected: fixed in 7.0.3-ga4.

### [CVE-2016-10404](https://cve.now/CVE-2016-10404): XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted redirect field to…

- Severity: Unrated
- Published: Aug 7, 2017
- Affected: fixed in 7.0.3-ga4.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/com.liferay.portal:release.portal.bom
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.