Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools

Liferay, Inc.

#8b54e794-c6f0-462e-9faa-c1001a673ac3
PolicyEmail

Short Name

Liferay

Program Role

CNA

Top Level Root

MITRE Corporation

Security Advisories

View Advisories

Domain

liferay.com

Country

USA

Scope

All Liferay supported products and end-of-life/end-of-service products.
Reported CVEsVendorsProductsReports
118Vulnerabilities found
CVE-2025-43764
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.03% / 7.16%
||
7 Day CHG~0.00%
Published-23 Aug, 2025 | 04:49
Updated-25 Aug, 2025 | 20:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.1, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92, which allows authenticated users with permissions to update Kaleo Workflows to enter a malicious Regex pattern causing their browser to hang for a very long time.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-1333
Inefficient Regular Expression Complexity
CVE-2025-43765
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.05% / 13.81%
||
7 Day CHG~0.00%
Published-23 Aug, 2025 | 04:32
Updated-25 Aug, 2025 | 20:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the text field from a web content.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43766
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-6.8||MEDIUM
EPSS-0.06% / 19.88%
||
7 Day CHG~0.00%
Published-23 Aug, 2025 | 04:17
Updated-25 Aug, 2025 | 20:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows the upload of unrestricted files in the style books component that are processed within the environment enabling arbitrary code execution by attackers.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-434
Unrestricted Upload of File with Dangerous Type
CVE-2025-43767
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.1||MEDIUM
EPSS-0.04% / 11.27%
||
7 Day CHG~0.00%
Published-23 Aug, 2025 | 03:41
Updated-25 Aug, 2025 | 20:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 update 86 through update 92 allows an attacker to exploit this security vulnerability to redirect users to a malicious site.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-601
URL Redirection to Untrusted Site ('Open Redirect')
CVE-2025-43768
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.1||MEDIUM
EPSS-0.03% / 8.10%
||
7 Day CHG~0.00%
Published-23 Aug, 2025 | 03:04
Updated-25 Aug, 2025 | 20:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows authenticated users without any permissions to access sensitive information of admin users using JSONWS APIs.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-201
Insertion of Sensitive Information Into Sent Data
CVE-2025-43769
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-4.6||MEDIUM
EPSS-0.19% / 40.93%
||
7 Day CHG~0.00%
Published-23 Aug, 2025 | 02:49
Updated-25 Aug, 2025 | 20:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute arbitrary web script or HTML via components tab.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43770
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.05% / 13.81%
||
7 Day CHG~0.00%
Published-23 Aug, 2025 | 01:03
Updated-25 Aug, 2025 | 20:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the referer or FORWARD_URL using %00 in those parameters.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43761
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.05% / 13.81%
||
7 Day CHG~0.00%
Published-22 Aug, 2025 | 20:25
Updated-25 Aug, 2025 | 20:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the frontend-editor-ckeditor-web/ckeditor/samples/old/ajax.html path

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43759
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.04% / 8.59%
||
7 Day CHG~0.00%
Published-22 Aug, 2025 | 19:07
Updated-26 Aug, 2025 | 14:06
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows admin users of a virtual instance to add pages that are not in the default/main virtual instance, then any tenant can create a list of all other tenants.

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-732
Incorrect Permission Assignment for Critical Resource
CVE-2025-43762
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.3||MEDIUM
EPSS-0.04% / 11.73%
||
7 Day CHG~0.00%
Published-22 Aug, 2025 | 18:43
Updated-25 Aug, 2025 | 20:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the forms, the files are stored in the document_library allowing an attacker to cause a potential DDoS.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-770
Allocation of Resources Without Limits or Throttling
CVE-2025-43758
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.3||MEDIUM
EPSS-0.05% / 15.57%
||
7 Day CHG~0.00%
Published-22 Aug, 2025 | 18:18
Updated-25 Aug, 2025 | 20:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded by object entry and stored in document_library

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-552
Files or Directories Accessible to External Parties
CVE-2025-43760
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.3||MEDIUM
EPSS-0.22% / 44.76%
||
7 Day CHG~0.00%
Published-22 Aug, 2025 | 17:34
Updated-25 Aug, 2025 | 20:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43751
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.20% / 42.31%
||
7 Day CHG~0.00%
Published-22 Aug, 2025 | 15:58
Updated-22 Aug, 2025 | 18:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10 and 7.4 GA through update 92 allows remote attackers to determine if an account exist in the application via the create account page.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-203
Observable Discrepancy
CVE-2025-43752
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.3||MEDIUM
EPSS-0.04% / 11.73%
||
7 Day CHG~0.00%
Published-22 Aug, 2025 | 00:00
Updated-22 Aug, 2025 | 18:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the object entries attachment fields, the files are stored in the document_library allowing an attacker to cause a potential DDoS.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-770
Allocation of Resources Without Limits or Throttling
CVE-2025-43753
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-2.1||LOW
EPSS-0.15% / 36.29%
||
7 Day CHG~0.00%
Published-21 Aug, 2025 | 22:23
Updated-22 Aug, 2025 | 18:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 update 32 through update 92 allows an remote authenticated user to inject JavaScript into the embedded message field from the form container.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43747
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-4.8||MEDIUM
EPSS-0.04% / 8.59%
||
7 Day CHG~0.00%
Published-21 Aug, 2025 | 20:23
Updated-22 Aug, 2025 | 18:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.domain.allowed, allowing an attacker to perform requests by change the domain and bypassing the validation method, this insecure validation is not distinguishing between trusted subdomains and malicious domains.

Action-Not Available
Vendor-Liferay Inc.
Product-DXP
CWE ID-CWE-918
Server-Side Request Forgery (SSRF)
CVE-2025-43754
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.04% / 11.73%
||
7 Day CHG~0.00%
Published-21 Aug, 2025 | 17:10
Updated-22 Aug, 2025 | 18:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers to determine if an account exist in the application by inspecting the server processing time of the login request.

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-208
Observable Timing Discrepancy
CVE-2025-43755
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.1||MEDIUM
EPSS-0.14% / 34.54%
||
7 Day CHG~0.00%
Published-21 Aug, 2025 | 16:40
Updated-22 Aug, 2025 | 18:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.13, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_type parameter.

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43756
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.17% / 37.99%
||
7 Day CHG~0.00%
Published-21 Aug, 2025 | 16:19
Updated-22 Aug, 2025 | 18:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

<!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}-->A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.15, 2025.Q2.0 through 2025.Q2.2 and 2024.Q1.13 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via snippet parameter.

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43757
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-4.8||MEDIUM
EPSS-0.18% / 40.23%
||
7 Day CHG~0.00%
Published-20 Aug, 2025 | 19:13
Updated-22 Aug, 2025 | 18:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter.

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43746
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.1||MEDIUM
EPSS-0.18% / 40.23%
||
7 Day CHG~0.00%
Published-20 Aug, 2025 | 18:37
Updated-22 Aug, 2025 | 18:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_portletNamespace and _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_namespace parameter.

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43748
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-7.1||HIGH
EPSS-0.02% / 4.32%
||
7 Day CHG~0.00%
Published-20 Aug, 2025 | 14:28
Updated-22 Aug, 2025 | 18:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-43749
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.3||MEDIUM
EPSS-0.09% / 26.58%
||
7 Day CHG~0.00%
Published-20 Aug, 2025 | 12:32
Updated-20 Aug, 2025 | 15:12
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded in the form and stored in document_library

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-552
Files or Directories Accessible to External Parties
CVE-2025-43750
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.1||MEDIUM
EPSS-0.06% / 17.12%
||
7 Day CHG~0.00%
Published-20 Aug, 2025 | 12:12
Updated-20 Aug, 2025 | 15:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote unauthenticated users (guests) to upload files via the form attachment field without proper validation, enabling extension obfuscation and bypassing MIME type checks.

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-434
Unrestricted Upload of File with Dangerous Type
CVE-2025-43741
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.1||MEDIUM
EPSS-0.17% / 38.46%
||
7 Day CHG~0.00%
Published-20 Aug, 2025 | 11:54
Updated-20 Aug, 2025 | 15:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScrip in the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_assetTagNames parameter

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43742
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.06% / 19.37%
||
7 Day CHG~0.00%
Published-20 Aug, 2025 | 11:35
Updated-20 Aug, 2025 | 14:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript in web content for friendly urls.

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43744
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.1||MEDIUM
EPSS-0.05% / 15.86%
||
7 Day CHG~0.00%
Published-19 Aug, 2025 | 19:34
Updated-20 Aug, 2025 | 14:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 exists in the Asset Publisher configuration UI within the Source.js module. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels which are then inserted into the DOM using innerHTML without proper encoding.

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43743
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.3||MEDIUM
EPSS-0.16% / 37.83%
||
7 Day CHG~0.00%
Published-19 Aug, 2025 | 19:13
Updated-20 Aug, 2025 | 14:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated remote user to view other calendars by allowing them to enumerate the names of other users, given an attacker the possibility to send phishing to these users.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-203
Observable Discrepancy
CVE-2025-43745
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.06% / 19.97%
||
7 Day CHG~0.00%
Published-19 Aug, 2025 | 18:39
Updated-20 Aug, 2025 | 14:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote attackers to performs cross-origin request on behalf of the authenticated user via the endpoint parameter.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-43737
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.1||MEDIUM
EPSS-0.17% / 38.46%
||
7 Day CHG~0.00%
Published-19 Aug, 2025 | 18:13
Updated-20 Aug, 2025 | 14:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote authenticated user to inject JavaScript code via _com_liferay_journal_web_portlet_JournalPortlet_backURL parameter.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43738
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.1||MEDIUM
EPSS-0.23% / 45.60%
||
7 Day CHG~0.00%
Published-19 Aug, 2025 | 15:50
Updated-20 Aug, 2025 | 14:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via _com_liferay_expando_web_portlet_ExpandoPortlet_displayType parameter.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43739
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.3||MEDIUM
EPSS-0.06% / 17.16%
||
7 Day CHG~0.00%
Published-19 Aug, 2025 | 13:54
Updated-20 Aug, 2025 | 14:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allow any authenticated user to modify the content of emails sent through the calendar portlet, allowing an attacker to send phishing emails to any other user in the same organization.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-203
Observable Discrepancy
CVE-2025-43740
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-4.6||MEDIUM
EPSS-0.18% / 40.23%
||
7 Day CHG~0.00%
Published-19 Aug, 2025 | 13:03
Updated-19 Aug, 2025 | 13:42
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.9 through 2024.Q1.19 allows an remote authenticated attacker to inject JavaScript through the message boards feature available via the web interface.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43731
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.22% / 44.25%
||
7 Day CHG+0.05%
Published-18 Aug, 2025 | 18:20
Updated-18 Aug, 2025 | 20:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-3639
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-2||LOW
EPSS-0.06% / 17.09%
||
7 Day CHG+0.01%
Published-18 Aug, 2025 | 16:48
Updated-18 Aug, 2025 | 20:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-288
Authentication Bypass Using an Alternate Path or Channel
CVE-2025-43732
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-4.8||MEDIUM
EPSS-0.06% / 17.23%
||
7 Day CHG+0.01%
Published-18 Aug, 2025 | 13:20
Updated-18 Aug, 2025 | 20:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 is vulnerable to Insecure Direct Object Reference (IDOR) in the groupId parameter of the _com_liferay_roles_selector_web_portlet_RolesSelectorPortlet_groupId. When an organization administrator modifies this parameter id value, they can gain unauthorized access to user lists from other organizations.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-639
Authorization Bypass Through User-Controlled Key
CVE-2025-43733
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-2.3||LOW
EPSS-0.20% / 42.25%
||
7 Day CHG+0.05%
Published-18 Aug, 2025 | 12:06
Updated-18 Aug, 2025 | 20:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated attacker to inject JavaScript code via the content page's name field. This malicious payload is then reflected and executed within the user's browser when viewing the "document View Usages" page.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43734
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.1||MEDIUM
EPSS-0.22% / 44.25%
||
7 Day CHG~0.00%
Published-12 Aug, 2025 | 18:51
Updated-13 Aug, 2025 | 17:33
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page.

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43735
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.06% / 19.37%
||
7 Day CHG~0.00%
Published-12 Aug, 2025 | 12:19
Updated-12 Aug, 2025 | 14:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-43736
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.06% / 17.08%
||
7 Day CHG~0.00%
Published-12 Aug, 2025 | 11:01
Updated-12 Aug, 2025 | 18:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload more than 300kb profile picture into the user profile. This size more than the noted max 300kb size. This extra amount of data can make Liferay slower.

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-770
Allocation of Resources Without Limits or Throttling
CVE-2025-4655
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.1||MEDIUM
EPSS-0.05% / 13.64%
||
7 Day CHG~0.00%
Published-09 Aug, 2025 | 04:46
Updated-11 Aug, 2025 | 18:52
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-918
Server-Side Request Forgery (SSRF)
CVE-2025-4581
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-5.3||MEDIUM
EPSS-0.06% / 18.48%
||
7 Day CHG~0.00%
Published-09 Aug, 2025 | 04:14
Updated-11 Aug, 2025 | 18:52
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-918
Server-Side Request Forgery (SSRF)
CVE-2025-4576
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.06% / 19.37%
||
7 Day CHG~0.00%
Published-08 Aug, 2025 | 15:42
Updated-08 Aug, 2025 | 20:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/blogs/blogs-web/src/main/resources/META-INF/resources/blogs/entry_cover_image_caption.jsp

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-4604
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.05% / 15.86%
||
7 Day CHG~0.00%
Published-04 Aug, 2025 | 22:08
Updated-05 Aug, 2025 | 14:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.0 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7, 2025.Q1.0 through 2025.Q1.15 and 7.4 update 80 through update 92 and then attackers can run scripts in the Gogo shell

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-4599
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-2||LOW
EPSS-0.06% / 17.50%
||
7 Day CHG~0.00%
Published-04 Aug, 2025 | 21:18
Updated-05 Aug, 2025 | 15:43
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 update 61 through update 92 was found to be vulnerable to postMessage-based XSS because it allows a remote non-authenticated attacker to inject JavaScript into the fragment portlet URL.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-3526
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-8.7||HIGH
EPSS-0.41% / 60.43%
||
7 Day CHG+0.02%
Published-16 Jun, 2025 | 14:18
Updated-17 Jun, 2025 | 20:50
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsupported versions does not restrict the saving of request parameters in the HTTP session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP requests.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-400
Uncontrolled Resource Consumption
CVE-2025-3594
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-8.6||HIGH
EPSS-0.34% / 55.73%
||
7 Day CHG+0.02%
Published-16 Jun, 2025 | 14:13
Updated-22 Aug, 2025 | 03:55
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 34, and older unsupported versions allows remote attackers to (1) add files to arbitrary locations on the server and (2) download and execute arbitrary files from the download server via the `_com_liferay_server_admin_web_portlet_ServerAdminPortlet_jarName` parameter.

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-3602
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-8.7||HIGH
EPSS-0.15% / 36.59%
||
7 Day CHG+0.01%
Published-16 Jun, 2025 | 13:50
Updated-17 Jun, 2025 | 20:50
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does not limit the depth of a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing complex queries.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-400
Uncontrolled Resource Consumption
CVE-2025-4388
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-6.9||MEDIUM
EPSS-5.94% / 90.28%
||
7 Day CHG~0.00%
Published-06 May, 2025 | 18:01
Updated-07 May, 2025 | 14:13
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.

Action-Not Available
Vendor-Liferay Inc.
Product-DXPPortal
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-3760
Assigner-Liferay, Inc.
ShareView Details
Assigner-Liferay, Inc.
CVSS Score-4.8||MEDIUM
EPSS-0.29% / 52.15%
||
7 Day CHG~0.00%
Published-17 Apr, 2025 | 12:53
Updated-17 Apr, 2025 | 20:21
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page.

Action-Not Available
Vendor-Liferay Inc.
Product-PortalDXP
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • Previous
  • 1
  • 2
  • 3
  • Next