# cve.now: Liferay

The newest entries naming Liferay as an affected vendor (up to 200), of 210 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-62275](https://cve.now/CVE-2025-62275.md): Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 thr (CVSS 6.9)
- [CVE-2025-62276](https://cve.now/CVE-2025-62276.md): The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay D (CVSS 4.6)
- [CVE-2025-62267](https://cve.now/CVE-2025-62267.md): Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3 (CVSS 4.6)
- [CVE-2025-62264](https://cve.now/CVE-2025-62264.md): Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q (CVSS 5.1)
- [CVE-2025-62265](https://cve.now/CVE-2025-62265.md): Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and (CVSS 4.8)
- [CVE-2025-62266](https://cve.now/CVE-2025-62266.md): By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 t (CVSS 5.1)
- [CVE-2025-62257](https://cve.now/CVE-2025-62257.md): Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 thro (CVSS 6.3)
- [CVE-2025-62258](https://cve.now/CVE-2025-62258.md): CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through up (CVSS 7.0)
- [CVE-2025-62259](https://cve.now/CVE-2025-62259.md): Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 9 (CVSS 6.9)
- [CVE-2025-62260](https://cve.now/CVE-2025-62260.md): Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and (CVSS 7.1)
- [CVE-2025-62261](https://cve.now/CVE-2025-62261.md): Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 (CVSS 6.9)
- [CVE-2025-62262](https://cve.now/CVE-2025-62262.md): Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported v (CVSS 4.6)
- [CVE-2025-62263](https://cve.now/CVE-2025-62263.md): Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, (CVSS 4.8)
- [CVE-2025-62253](https://cve.now/CVE-2025-62253.md): Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP (CVSS 6.9)
- [CVE-2025-62254](https://cve.now/CVE-2025-62254.md): The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 202 (CVSS 6.9)
- [CVE-2025-62255](https://cve.now/CVE-2025-62255.md): Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older u (CVSS 2.0)
- [CVE-2025-62256](https://cve.now/CVE-2025-62256.md): Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, (CVSS 6.9)
- [CVE-2025-62247](https://cve.now/CVE-2025-62247.md): Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025 (CVSS 2.0)
- [CVE-2025-62248](https://cve.now/CVE-2025-62248.md): A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4. (CVSS 4.8)
- [CVE-2025-62249](https://cve.now/CVE-2025-62249.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q (CVSS 6.9)
- [CVE-2025-62250](https://cve.now/CVE-2025-62250.md): Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 thro (CVSS 6.9)
- [CVE-2025-62251](https://cve.now/CVE-2025-62251.md): Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 a (CVSS 4.8)
- [CVE-2025-62252](https://cve.now/CVE-2025-62252.md): Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay (CVSS 5.3)
- [CVE-2025-62246](https://cve.now/CVE-2025-62246.md): Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Li (CVSS 4.8)
- [CVE-2025-62241](https://cve.now/CVE-2025-62241.md): Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authe (CVSS 5.3)
- [CVE-2025-62242](https://cve.now/CVE-2025-62242.md): Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 20 (CVSS 5.3)
- [CVE-2025-62243](https://cve.now/CVE-2025-62243.md): Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 t (CVSS 5.3)
- [CVE-2025-62244](https://cve.now/CVE-2025-62244.md): Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 t (CVSS 4.8)
- [CVE-2025-62245](https://cve.now/CVE-2025-62245.md): Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023 (CVSS 5.1)
- [CVE-2025-62237](https://cve.now/CVE-2025-62237.md): Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2 (CVSS 4.8)
- [CVE-2025-62238](https://cve.now/CVE-2025-62238.md): Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 through 7.4.3.111, and (CVSS 4.8)
- [CVE-2025-62239](https://cve.now/CVE-2025-62239.md): Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 (CVSS 4.6)
- [CVE-2025-62240](https://cve.now/CVE-2025-62240.md): Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023. (CVSS 4.8)
- [CVE-2025-43771](https://cve.now/CVE-2025-43771.md): Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay D (CVSS 4.8)
- [CVE-2025-43829](https://cve.now/CVE-2025-43829.md): Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.18 through 7.4.3.111, and Lifer (CVSS 4.8)
- [CVE-2025-43830](https://cve.now/CVE-2025-43830.md): Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q (CVSS 5.1)
- [CVE-2025-43821](https://cve.now/CVE-2025-43821.md): Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4.0 through 7.4.3.111, and Life (CVSS 4.8)
- [CVE-2025-43822](https://cve.now/CVE-2025-43822.md): Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2 (CVSS 4.8)
- [CVE-2025-43823](https://cve.now/CVE-2025-43823.md): Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 202 (CVSS 4.8)
- [CVE-2025-43824](https://cve.now/CVE-2025-43824.md): The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2 (CVSS 4.8)
- [CVE-2025-43825](https://cve.now/CVE-2025-43825.md): A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3 (CVSS 4.6)
- [CVE-2025-43826](https://cve.now/CVE-2025-43826.md): Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupporte (CVSS 4.8)
- [CVE-2025-43827](https://cve.now/CVE-2025-43827.md): Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported ver (CVSS 5.3)
- [CVE-2025-43817](https://cve.now/CVE-2025-43817.md): Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 throug (CVSS 4.8)
- [CVE-2025-43813](https://cve.now/CVE-2025-43813.md): Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsuppo (CVSS 6.9)
- [CVE-2025-43812](https://cve.now/CVE-2025-43812.md): Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 thro (CVSS 4.8)
- [CVE-2025-43811](https://cve.now/CVE-2025-43811.md): Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Lif (CVSS 4.8)
- [CVE-2025-43820](https://cve.now/CVE-2025-43820.md): Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through (CVSS 4.8)
- [CVE-2025-43818](https://cve.now/CVE-2025-43818.md): Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 thro (CVSS 4.8)
- [CVE-2025-43815](https://cve.now/CVE-2025-43815.md): Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay (CVSS 5.1)
- [CVE-2025-43816](https://cve.now/CVE-2025-43816.md): A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Life (CVSS 6.9)
- [CVE-2025-43819](https://cve.now/CVE-2025-43819.md): A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4 (CVSS 5.3)
- [CVE-2025-43779](https://cve.now/CVE-2025-43779.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q (CVSS 6.9)
- [CVE-2025-43814](https://cve.now/CVE-2025-43814.md): In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 20 (CVSS 6.9)
- [CVE-2025-43810](https://cve.now/CVE-2025-43810.md): Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2 (CVSS 5.3)
- [CVE-2025-43806](https://cve.now/CVE-2025-43806.md): Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 G (CVSS 5.3)
- [CVE-2025-43807](https://cve.now/CVE-2025-43807.md): Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023. (CVSS 4.8)
- [CVE-2025-43808](https://cve.now/CVE-2025-43808.md): The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, (CVSS 6.9)
- [CVE-2025-43809](https://cve.now/CVE-2025-43809.md): Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and old (CVSS 5.1)
- [CVE-2025-43803](https://cve.now/CVE-2025-43803.md): Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older uns (CVSS 6.9)
- [CVE-2025-43804](https://cve.now/CVE-2025-43804.md): Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 (CVSS 5.1)
- [CVE-2025-43805](https://cve.now/CVE-2025-43805.md): Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through (CVSS 6.9)
- [CVE-2025-43801](https://cve.now/CVE-2025-43801.md): Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and L (CVSS 6.9)
- [CVE-2025-43802](https://cve.now/CVE-2025-43802.md): Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/\<object-name\> API endpoint in Liferay Portal 7.4.3.51 through 7.4. (CVSS 4.8)
- [CVE-2025-43797](https://cve.now/CVE-2025-43797.md): In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through (CVSS 5.3)
- [CVE-2025-43798](https://cve.now/CVE-2025-43798.md): Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time passw (CVSS 2.1)
- [CVE-2025-43799](https://cve.now/CVE-2025-43799.md): Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA throu (CVSS 6.9)
- [CVE-2025-43800](https://cve.now/CVE-2025-43800.md): Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 throu (CVSS 4.8)
- [CVE-2025-43791](https://cve.now/CVE-2025-43791.md): Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through (CVSS 4.8)
- [CVE-2025-43792](https://cve.now/CVE-2025-43792.md): Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023. (CVSS 2.3)
- [CVE-2025-43793](https://cve.now/CVE-2025-43793.md): Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA throu (CVSS 6.9)
- [CVE-2025-43794](https://cve.now/CVE-2025-43794.md): Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2 (CVSS 4.6)
- [CVE-2025-43795](https://cve.now/CVE-2025-43795.md): Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , (CVSS 5.1)
- [CVE-2025-43796](https://cve.now/CVE-2025-43796.md): Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 do (CVSS 7.1)
- [CVE-2025-43787](https://cve.now/CVE-2025-43787.md): A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0, 2025.Q2.0 through 202 (CVSS 5.1)
- [CVE-2025-43788](https://cve.now/CVE-2025-43788.md): The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through (CVSS 5.3)
- [CVE-2025-43789](https://cve.now/CVE-2025-43789.md): JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published (CVSS 1.0)
- [CVE-2025-43790](https://cve.now/CVE-2025-43790.md): Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6 (CVSS 7.4)
- [CVE-2025-43782](https://cve.now/CVE-2025-43782.md): Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7 (CVSS 5.3)
- [CVE-2025-43783](https://cve.now/CVE-2025-43783.md): Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1 (CVSS 5.1)
- [CVE-2025-43784](https://cve.now/CVE-2025-43784.md): Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 thr (CVSS 6.2)
- [CVE-2025-43785](https://cve.now/CVE-2025-43785.md): Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2 (CVSS 4.6)
- [CVE-2025-43786](https://cve.now/CVE-2025-43786.md): Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 throu (CVSS 6.9)
- [CVE-2025-43781](https://cve.now/CVE-2025-43781.md): Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3. (CVSS 5.3)
- [CVE-2025-43775](https://cve.now/CVE-2025-43775.md): Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024 (CVSS 4.6)
- [CVE-2025-43776](https://cve.now/CVE-2025-43776.md): A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 202 (CVSS 4.6)
- [CVE-2025-43777](https://cve.now/CVE-2025-43777.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q (CVSS 5.1)
- [CVE-2025-43778](https://cve.now/CVE-2025-43778.md): A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 20 (CVSS 4.8)
- [CVE-2025-43763](https://cve.now/CVE-2025-43763.md): A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2 (CVSS 4.8)
- [CVE-2025-43772](https://cve.now/CVE-2025-43772.md): Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions (CVSS 7.1)
- [CVE-2025-3586](https://cve.now/CVE-2025-3586.md): In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2 (CVSS 7.5)
- [CVE-2025-43773](https://cve.now/CVE-2025-43773.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 thr (CVSS 4.6)
- [CVE-2025-43764](https://cve.now/CVE-2025-43764.md): Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal (CVSS 6.9)
- [CVE-2025-43765](https://cve.now/CVE-2025-43765.md): A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024 (CVSS 6.9)
- [CVE-2025-43766](https://cve.now/CVE-2025-43766.md): The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 (CVSS 6.8)
- [CVE-2025-43767](https://cve.now/CVE-2025-43767.md): Open Redirect vulnerability in /c/portal/edit\_info\_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 202 (CVSS 5.1)
- [CVE-2025-43768](https://cve.now/CVE-2025-43768.md): Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2 (CVSS 5.1)
- [CVE-2025-43769](https://cve.now/CVE-2025-43769.md): Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024 (CVSS 4.6)
- [CVE-2025-43770](https://cve.now/CVE-2025-43770.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q (CVSS 6.9)
- [CVE-2025-43761](https://cve.now/CVE-2025-43761.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q (CVSS 6.9)
- [CVE-2025-43759](https://cve.now/CVE-2025-43759.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 thro (CVSS 6.7)
- [CVE-2025-43762](https://cve.now/CVE-2025-43762.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3. (CVSS 5.3)
- [CVE-2025-43758](https://cve.now/CVE-2025-43758.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3. (CVSS 5.3)
- [CVE-2025-43760](https://cve.now/CVE-2025-43760.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q (CVSS 5.3)
- [CVE-2025-43751](https://cve.now/CVE-2025-43751.md): User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 202 (CVSS 6.9)
- [CVE-2025-43752](https://cve.now/CVE-2025-43752.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3. (CVSS 5.3)
- [CVE-2025-43753](https://cve.now/CVE-2025-43753.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 202 (CVSS 2.1)
- [CVE-2025-43747](https://cve.now/CVE-2025-43747.md): A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation o (CVSS 4.8)
- [CVE-2025-43754](https://cve.now/CVE-2025-43754.md): Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through (CVSS 6.9)
- [CVE-2025-43755](https://cve.now/CVE-2025-43755.md): A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 20 (CVSS 5.1)
- [CVE-2025-43756](https://cve.now/CVE-2025-43756.md): \<!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}--\>A reflected cross-site scripting (XSS) vulnerability in the Liferay (CVSS 6.9)
- [CVE-2025-43757](https://cve.now/CVE-2025-43757.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q (CVSS 4.8)
- [CVE-2025-43746](https://cve.now/CVE-2025-43746.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q (CVSS 5.1)
- [CVE-2025-43748](https://cve.now/CVE-2025-43748.md): Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024. (CVSS 7.1)
- [CVE-2025-43749](https://cve.now/CVE-2025-43749.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3. (CVSS 5.3)
- [CVE-2025-43750](https://cve.now/CVE-2025-43750.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3. (CVSS 5.1)
- [CVE-2025-43741](https://cve.now/CVE-2025-43741.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q (CVSS 5.1)
- [CVE-2025-43742](https://cve.now/CVE-2025-43742.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q (CVSS 6.9)
- [CVE-2025-43744](https://cve.now/CVE-2025-43744.md): A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 202 (CVSS 5.1)
- [CVE-2025-43743](https://cve.now/CVE-2025-43743.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3. (CVSS 5.3)
- [CVE-2025-43745](https://cve.now/CVE-2025-43745.md): A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2 (CVSS 6.9)
- [CVE-2025-43737](https://cve.now/CVE-2025-43737.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q (CVSS 5.1)
- [CVE-2025-43738](https://cve.now/CVE-2025-43738.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q (CVSS 5.1)
- [CVE-2025-43739](https://cve.now/CVE-2025-43739.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3. (CVSS 5.3)
- [CVE-2025-43740](https://cve.now/CVE-2025-43740.md): A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, (CVSS 4.6)
- [CVE-2025-43731](https://cve.now/CVE-2025-43731.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q (CVSS 6.9)
- [CVE-2025-3639](https://cve.now/CVE-2025-3639.md): Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13 (CVSS 2.0)
- [CVE-2025-43732](https://cve.now/CVE-2025-43732.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3 (CVSS 4.8)
- [CVE-2025-43733](https://cve.now/CVE-2025-43733.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a r (CVSS 2.3)
- [CVE-2025-43734](https://cve.now/CVE-2025-43734.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q (CVSS 5.1)
- [CVE-2025-43735](https://cve.now/CVE-2025-43735.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q (CVSS 6.9)
- [CVE-2025-43736](https://cve.now/CVE-2025-43736.md): A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2 (CVSS 6.9)
- [CVE-2025-4655](https://cve.now/CVE-2025-4655.md): SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 (CVSS 5.1)
- [CVE-2025-4581](https://cve.now/CVE-2025-4581.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3. (CVSS 5.3)
- [CVE-2025-4576](https://cve.now/CVE-2025-4576.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q (CVSS 6.9)
- [CVE-2025-4604](https://cve.now/CVE-2025-4604.md): The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, (CVSS 6.9)
- [CVE-2025-4599](https://cve.now/CVE-2025-4599.md): The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 thro (CVSS 2.0)
- [CVE-2025-3526](https://cve.now/CVE-2025-3526.md): SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsuppo (CVSS 8.7)
- [CVE-2025-3594](https://cve.now/CVE-2025-3594.md): Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 G (CVSS 8.6)
- [CVE-2025-3602](https://cve.now/CVE-2025-3602.md): Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and (CVSS 8.7)
- [CVE-2025-4388](https://cve.now/CVE-2025-4388.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q (CVSS 6.9)
- [CVE-2025-3760](https://cve.now/CVE-2025-3760.md): A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and (CVSS 4.8)
- [CVE-2025-2565](https://cve.now/CVE-2025-2565.md): The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1. (CVSS 5.1)
- [CVE-2025-2536](https://cve.now/CVE-2025-2536.md): Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2. (CVSS 5.1)
- [CVE-2023-37940](https://cve.now/CVE-2023-37940.md): Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7. (CVSS 4.8)
- [CVE-2024-11993](https://cve.now/CVE-2024-11993.md): Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows (CVSS 4.6)
- [CVE-2024-38002](https://cve.now/CVE-2024-38002.md): The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through… (CVSS 9.3)
- [CVE-2024-26273](https://cve.now/CVE-2024-26273.md): Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q (CVSS 8.8)
- [CVE-2024-26272](https://cve.now/CVE-2024-26272.md): Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q (CVSS 8.8)
- [CVE-2024-8980](https://cve.now/CVE-2024-8980.md): The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA (CVSS 9.6)
- [CVE-2024-26271](https://cve.now/CVE-2024-26271.md): Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023. (CVSS 8.8)
- [CVE-2023-47795](https://cve.now/CVE-2023-47795.md): Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay D (CVSS 9.0)
- [CVE-2024-25151](https://cve.now/CVE-2024-25151.md): The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 be (CVSS 5.4)
- [CVE-2023-40191](https://cve.now/CVE-2023-40191.md): Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Li (CVSS 9.0)
- [CVE-2023-42498](https://cve.now/CVE-2023-42498.md): Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Life (CVSS 9.6)
- [CVE-2024-26269](https://cve.now/CVE-2024-26269.md): Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7. (CVSS 9.6)
- [CVE-2024-26266](https://cve.now/CVE-2024-26266.md): Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Lif (CVSS 9.0)
- [CVE-2023-42496](https://cve.now/CVE-2023-42496.md): Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay (CVSS 9.6)
- [CVE-2024-25603](https://cve.now/CVE-2024-25603.md): Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and ol (CVSS 9.0)
- [CVE-2024-25152](https://cve.now/CVE-2024-25152.md): Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported version (CVSS 9.0)
- [CVE-2024-25601](https://cve.now/CVE-2024-25601.md): Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and old (CVSS 9.0)
- [CVE-2024-25602](https://cve.now/CVE-2024-25602.md): Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsu (CVSS 9.0)
- [CVE-2024-25147](https://cve.now/CVE-2024-25147.md): Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and (CVSS 9.6)
- [CVE-2024-26270](https://cve.now/CVE-2024-26270.md): The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 (CVSS 6.5)
- [CVE-2024-26268](https://cve.now/CVE-2024-26268.md): User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 2 (CVSS 5.3)
- [CVE-2024-26267](https://cve.now/CVE-2024-26267.md): In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 bef (CVSS 5.3)
- [CVE-2024-26265](https://cve.now/CVE-2024-26265.md): The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7. (CVSS 5.0)
- [CVE-2024-25610](https://cve.now/CVE-2024-25610.md): In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 befo (CVSS 9.0)
- [CVE-2024-25609](https://cve.now/CVE-2024-25609.md): HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 s (CVSS 6.1)
- [CVE-2024-25608](https://cve.now/CVE-2024-25608.md): HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 (CVSS 6.1)
- [CVE-2024-25607](https://cve.now/CVE-2024-25607.md): The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Life (CVSS 8.1)
- [CVE-2024-25606](https://cve.now/CVE-2024-25606.md): XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before u (CVSS 8.0)
- [CVE-2024-25605](https://cve.now/CVE-2024-25605.md): The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack (CVSS 5.3)
- [CVE-2024-25604](https://cve.now/CVE-2024-25604.md): Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack (CVSS 6.5)
- [CVE-2024-25150](https://cve.now/CVE-2024-25150.md): Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay (CVSS 4.3)
- [CVE-2024-25149](https://cve.now/CVE-2024-25149.md): Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and o (CVSS 5.4)
- [CVE-2023-44308](https://cve.now/CVE-2023-44308.md): Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows (CVSS 6.1)
- [CVE-2023-5190](https://cve.now/CVE-2023-5190.md): Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 202 (CVSS 6.1)
- [CVE-2024-25148](https://cve.now/CVE-2024-25148.md): In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, an (CVSS 5.4)
- [CVE-2024-25146](https://cve.now/CVE-2024-25146.md): Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and o (CVSS 5.3)
- [CVE-2024-25144](https://cve.now/CVE-2024-25144.md): The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before (CVSS 4.1)
- [CVE-2023-47798](https://cve.now/CVE-2023-47798.md): Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsu (CVSS 5.4)
- [CVE-2024-25145](https://cve.now/CVE-2024-25145.md): Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, an (CVSS 9.6)
- [CVE-2024-25143](https://cve.now/CVE-2024-25143.md): The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack (CVSS 6.5)
- [CVE-2023-47797](https://cve.now/CVE-2023-47797.md): Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote a (CVSS 9.6)
- [CVE-2023-42627](https://cve.now/CVE-2023-42627.md): Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP (CVSS 9.6)
- [CVE-2023-42628](https://cve.now/CVE-2023-42628.md): Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 (CVSS 9.0)
- [CVE-2023-44311](https://cve.now/CVE-2023-44311.md): Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class i (CVSS 9.6)
- [CVE-2023-44310](https://cve.now/CVE-2023-44310.md): Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 thro (CVSS 9.0)
- [CVE-2023-44309](https://cve.now/CVE-2023-44309.md): Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay (CVSS 9.0)
- [CVE-2023-42629](https://cve.now/CVE-2023-42629.md): Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 (CVSS 9.0)
- [CVE-2023-42497](https://cve.now/CVE-2023-42497.md): Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Lifera (CVSS 9.6)
- [CVE-2023-3426](https://cve.now/CVE-2023-3426.md): The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permissi (CVSS 4.3)
- [CVE-2023-35030](https://cve.now/CVE-2023-35030.md): Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Li (CVSS 8.8)
- [CVE-2023-35029](https://cve.now/CVE-2023-35029.md): Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update (CVSS 6.1)
- [CVE-2023-3193](https://cve.now/CVE-2023-3193.md): Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay D (CVSS 6.1)
- [CVE-2023-33950](https://cve.now/CVE-2023-33950.md): Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are (CVSS 6.5)
- [CVE-2023-33949](https://cve.now/CVE-2023-33949.md): In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email (CVSS 5.3)
- [CVE-2023-33948](https://cve.now/CVE-2023-33948.md): The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can (CVSS 5.3)
- [CVE-2023-33947](https://cve.now/CVE-2023-33947.md): The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by vir (CVSS 2.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/liferay
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.