Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

264 records

Vendor: Liferay Component: Digital Experience Platform Clear all filters
TI-2025-38577 CVE-2025-62275 · GHSA-xf7m-v66q-76w8

Incorrect authorization in Liferay Portal

Priority LOW 36

Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does n…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0029 Published 2025-11-01 Fixed in 6.0.19 CWE-863
TI-2025-38578 CVE-2025-62276 · GHSA-6533-fhr2-f38h

The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through…

Priority LOW 20

The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through up…

CVSS 4.0MEDIUM 4.6 Local No auth User interaction EPSS 0.00134 Published 2025-10-31 Fixed in 5.0.52, 69.1.0 CWE-525
TI-2025-38576 CVE-2025-62267 · GHSA-q285-wfpg-93hr

Cross-site scripting in Liferay Portal

Priority LOW 21

Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10…

CVSS 4.0MEDIUM 4.6 Network High privileges User interaction EPSS 0.00232 Published 2025-10-31 Fixed in 1.0.9 CWE-79
TI-2025-38573 CVE-2025-62264 · GHSA-2j97-4jmq-c4xf

Cross-site scripting in Liferay Portal

Priority LOW 23

Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through u…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00241 Published 2025-10-31 Fixed in 7.4.3.112-ga112 CWE-79
TI-2025-38574 CVE-2025-62265 · GHSA-56jv-4ww3-65mw

Cross-site scripting in Liferay Portal

Priority LOW 21

Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA th…

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.0022 Published 2025-10-30 Fixed in 7.4.3.112-ga112 CWE-79
TI-2025-38575 CVE-2025-62266 · GHSA-f5vh-4rj2-w8r8

Open redirect in Liferay Portal

Priority LOW 23

By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and o…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00228 Published 2025-10-30 Fixed in 7.4.3.110 CWE-601
TI-2025-38566 CVE-2025-62257 · GHSA-8hw3-ghwv-crfh

Missing brute-force protection in Liferay Portal

Priority LOW 28

Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 G…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00388 Published 2025-10-29 Fixed in 7.4.3.120 CWE-307
TI-2025-38567 CVE-2025-62258 · GHSA-gh4w-8qgq-8w9r

Cross-site request forgery in Liferay Portal

Priority LOW 30

CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote…

CVSS 4.0HIGH 7.0 Network No auth User interaction EPSS 0.00182 Published 2025-10-27 Fixed in 7.4.3.108 CWE-352
TI-2025-38568 CVE-2025-62259 · GHSA-gv7w-jh8g-vr73

Incorrect authorization in Liferay Portal

Priority LOW 30

Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit acces…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00224 Published 2025-10-27 Fixed in 7.4.3.110 CWE-863
TI-2025-38569 CVE-2025-62260 · GHSA-vgqx-447m-wvcj

Uncontrolled resource consumption in Liferay Portal

Priority LOW 31

Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from He…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00386 Published 2025-10-27 Fixed in 7.4.3.100 CWE-400
TI-2025-38570 CVE-2025-62261 · GHSA-xcj6-xpjg-c4xr

Cleartext storage of sensitive information in Liferay Portal

Priority LOW 30

Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset…

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00292 Published 2025-10-27 Fixed in 7.4.3.100, 92.0.2 CWE-312
TI-2025-38571 CVE-2025-62262 · GHSA-cw79-fq4f-9r96

Sensitive information in log files in Liferay Portal

Priority LOW 20

Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92,…

CVSS 4.0MEDIUM 4.6 Local High privileges No interaction EPSS 0.00143 Published 2025-10-27 Fixed in 4.0.54 CWE-532
TI-2025-38572 CVE-2025-62263 · GHSA-8mgf-rgg5-w38q

Cross-site scripting in Liferay Portal

Priority LOW 21

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 service pack 3 through update 36 allow remote atta…

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.0022 Published 2025-10-27 Fixed in 2.0.108 CWE-79
TI-2025-38562 CVE-2025-62253 · GHSA-2pwh-9q9q-5r9c

Open redirect in Liferay Portal

Priority LOW 36

Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA throug…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00248 Published 2025-10-27 Fixed in 5.0.157 CWE-601
TI-2025-38563 CVE-2025-62254 · GHSA-q95h-87j6-273x

Path traversal in Liferay Portal

Priority LOW 37

The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, 7.3 GA through update 35, an…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00553 Published 2025-10-23 Fixed in 97.0.0 CWE-22
TI-2025-38564 CVE-2025-62255 · GHSA-gccf-r9xp-x8jx

Cross-site scripting in Liferay Portal

Priority LOW 10

Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through…

CVSS 4.0LOW 2.0 Network Low privileges User interaction EPSS 0.00209 Published 2025-10-23 Fixed in 5.0.109 CWE-79
TI-2025-38565 CVE-2025-62256 · GHSA-j82q-c85j-xw4w

Missing authorization in Liferay Portal

Priority LOW 31

Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not properly restr…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00402 Published 2025-10-23 Fixed in 6.0.26 CWE-862
TI-2025-38556 CVE-2025-62247 · GHSA-cqwv-9xh5-25fg

Missing authorization in Liferay Portal

Priority LOW 10

Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 thro…

CVSS 4.0LOW 2.0 Network Low privileges User interaction EPSS 0.00268 Published 2025-10-22 No fix listed CWE-862
TI-2025-38557 CVE-2025-62248 · GHSA-phjr-p9c5-hprx

Cross-site scripting in Liferay Portal

Priority LOW 22

A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16,…

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00237 Published 2025-10-22 No fix listed CWE-79
TI-2025-38558 CVE-2025-62249 · GHSA-rx48-gqc2-4w47

Cross-site scripting in Liferay Portal

Priority LOW 30

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 throu…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00246 Published 2025-10-21 No fix listed CWE-79
TI-2025-38559 CVE-2025-62250 · GHSA-6pgj-w687-9c8c

Origin validation error in Liferay Portal

Priority LOW 36

Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older uns…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00172 Published 2025-10-21 Fixed in 5.0.35 CWE-346
TI-2025-38560 CVE-2025-62251 · GHSA-j4f7-gj7q-xg9m

Incorrect permission assignment in Liferay Portal

Priority LOW 22

Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows content to users who do not have permission to…

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00269 Published 2025-10-13 Fixed in 1.0.23 CWE-732
TI-2025-38561 CVE-2025-62252 · GHSA-pfwq-mr9g-gq6m

Authorization bypass in Liferay Portal

Priority LOW 24

Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through u…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00272 Published 2025-10-13 Fixed in 99.0.0 CWE-639
TI-2025-38555 CVE-2025-62246 · GHSA-mj68-2xr5-28xh

Cross-site scripting in Liferay Portal

Priority LOW 21

Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA throu…

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00225 Published 2025-10-13 Fixed in 6.0.35 CWE-79
TI-2025-38550 CVE-2025-62241 · GHSA-fhcw-px4q-pmvv

Authorization bypass in Liferay DXP

Priority LOW 24

Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to from one virtual instance to view the shipment addresses of di…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00279 Published 2025-10-13 Fixed in 4.0.114 CWE-639
Load more