DE
Product
Digital Experience Platform
264
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 35Medium 224Low 2
Watch
Add Digital Experience Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-33328 | 5.4 | Aug 3 | Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2025-62275 | 5.3 | Nov 1 | Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update… Affected: 7.4; 2023.q3.1; 2023.q3.2; 2023.q3.3; 2023.q3.4; 2023.q3.5; +16 more |
| CVE-2025-62257 | 5.3 | Oct 29 | Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through… Affected: through 7.4; 2023.q3.0; 2023.q4.0; 2024.q1.1; 2024.q1.2; 2024.q1.3; +2 more |
| CVE-2025-62256 | 5.3 | Oct 23 | Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older… Affected: 7.3; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43808 | 5.3 | Sep 19 | The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 before 2023.Q4.9; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43805 | 5.3 | Sep 16 | Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not perform an… Affected: 2023.Q3.0 before 2023.Q3.5; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43792 | 5.3 | Sep 15 | Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA… Affected: before 7.3; 2023.q3.1 before 2023.q3.5; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-43789 | 5.3 | Sep 12 | JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked… Affected: 2024.Q1.1 before 2024.Q1.10; 7.4; 7.4; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-43786 | 5.3 | Sep 9 | Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through… Affected: 2024.Q1.1 before 2024.Q1.13; 2024.q2.0 through 2024.q2.13; 2024.Q3.0 before 2024.Q3.2; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-43777 | 5.3 | Sep 9 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13,… Affected: 2024.q1.1 before 2024.q1.20; 2024.q2.0 through 2024.q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.q4.0 through 2024.q4.7; 2025.Q1.0 before 2025.Q1.17; 2025.Q2.0 before 2025.Q2.10 |
| CVE-2025-43758 | 5.3 | Aug 22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 2024.Q1.1 before 2024.Q1.16; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7; 2025.Q1.0 before 2025.Q1.6; 7.4 |
| CVE-2025-43751 | 5.3 | Aug 22 | User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.q4.0 through 2023.q4.10; 2024.Q1.11 before 2024.Q1.15; 2024.q2.0 through 2024.q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.q4.0 through 2024.q4.7; +34 more |
| CVE-2025-43754 | 5.3 | Aug 21 | Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through… Affected: 2024.Q1.1 before 2024.Q1.15; 2024.q2.0 through 2024.q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.q4.0 through 2024.q4.7; 7.4; 7.4; +34 more |
| CVE-2025-43749 | 5.3 | Aug 20 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 2024.Q1.1 before 2024.Q1.15; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7; 2025.Q1.0 before 2025.Q1.2; 7.4 |
| CVE-2024-26270 | 5.3 | Feb 20 | The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in… Affected: 7.4; 7.4; 7.4; 7.4; 7.4; 7.4; +16 more |
| CVE-2024-26268 | 5.3 | Feb 20 | User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +34 more |
| CVE-2024-26267 | 5.3 | Feb 20 | In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +34 more |
| CVE-2024-25605 | 5.3 | Feb 20 | The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +22 more |
| CVE-2024-25146 | 5.3 | Feb 8 | Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with… Affected: 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +12 more |
| CVE-2022-42127 | 5.3 | Nov 15 | The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers… Affected: 7.4; 7.4 |
| CVE-2022-42128 | 5.3 | Nov 15 | The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a… Affected: 7.4 |
| CVE-2022-25146 | 5.3 | Mar 2 | The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives… Affected: through 7.4 |
| CVE-2021-29040 | 5.3 | May 16 | The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose… Affected: before 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2020-15840 | 5.3 | Sep 24 | In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with… Affected: 7.0; 7.1; 7.2 |
| CVE-2025-4655 | 5.0 | Aug 9 | SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through… Affected: 2024.Q1.1 before 2024.Q1.16; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7; 2025.Q1.0 before 2025.Q1.6; 7.4; +34 more |
| CVE-2021-33325 | 4.9 | Aug 3 | The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2025-62248 | 4.8 | Oct 22 | A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0… Affected: 2024.q1.1 before 2024.q1.20; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7 |
| CVE-2025-43794 | 4.8 | Sep 15 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4,… Affected: before 7.3; 2023.q3.1 before 2023.q3.5; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2023-37940 | 4.8 | Dec 17 | Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through… Affected: 7.0 before 7.3; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2022-42131 | 4.8 | Nov 15 | Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers Affected: 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; +34 more |
| CVE-2021-33339 | 4.8 | Aug 4 | Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject… Affected: 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +3 more |
| CVE-2023-47798 | 4.6 | Feb 8 | Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2 |
| CVE-2025-62262 | 4.4 | Oct 27 | Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q3.1… Affected: 7.3; 7.3; 7.3; 7.3; 7.3; 7.3; +34 more |
| CVE-2025-62252 | 4.3 | Oct 13 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5,… Affected: through 7.4; 2023.Q3.1 through 2023.Q3.10; 2023.q4.0 before 2023.q4.6 |
| CVE-2025-62241 | 4.3 | Oct 13 | Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to from one virtual… Affected: 2023.q4.1; 2023.q4.2; 2023.q4.3; 2023.q4.4; 2023.q4.5 |
| CVE-2025-62242 | 4.3 | Oct 13 | Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1… Affected: 7.4; 2023.q3.1; 2023.q3.2; 2023.q3.3; 2023.q3.4; 2023.q3.5; +10 more |
| CVE-2025-62244 | 4.3 | Oct 13 | Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through… Affected: 2023.q3.1 before 2023.q3.9; 2023.q4.0 before 2023.q4.6; 7.3; 7.4 |
| CVE-2025-62245 | 4.3 | Oct 10 | Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.q4.0 before 2023.q4.6; 7.4 |
| CVE-2025-43827 | 4.3 | Sep 30 | Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1… Affected: through 7.3; 2023.Q3.1 through 2023.Q3.10; 2023.q4.0 through 2023.q4.10; 2024.Q1.1 before 2024.Q1.6; 7.4 |
| CVE-2025-43810 | 4.3 | Sep 22 | Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 before 2023.Q4.9; 7.4; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-43806 | 4.3 | Sep 22 | Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 does not properly… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 before 2023.Q4.8; 7.4; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-43809 | 4.3 | Sep 19 | Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay… Affected: through 7.4; 2023.q3.1 before 2023.q3.9; 2023.Q4.0 before 2023.Q4.8 |
| CVE-2025-43803 | 4.3 | Sep 19 | Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP… Affected: through 7.3; 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 before 2023.Q4.7; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-43788 | 4.3 | Sep 12 | The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user… Affected: 2024.Q1.1 before 2024.Q1.13; 7.4; 7.4; 7.4; 7.4; 7.4 |
| CVE-2025-43782 | 4.3 | Sep 11 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7, 2024.Q1.1 through 2024.Q1.12, and 7.4… Affected: 2024.Q1.1 before 2024.Q1.13; 2024.Q2.0 before 2024.Q2.8; 7.4 |
| CVE-2025-43743 | 4.3 | Aug 19 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 2024.Q1.1 before 2024.Q1.16; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7; 2025.Q1.0 before 2025.Q1.6; 7.4; +34 more |
| CVE-2025-43739 | 4.3 | Aug 19 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 2024.q1.1 through 2024.q1.19; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7; 2025.Q1.0 before 2025.Q1.7; 7.4; +34 more |
| CVE-2025-43736 | 4.3 | Aug 12 | A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7,… Affected: 2024.q1.1 through 2024.q1.16; 2024.Q2.1 through 2024.Q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7; 2025.q1.0 through 2025.q1.8; 7.4 |
| CVE-2025-2565 | 4.3 | Mar 20 | The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.q4.0 through 2023.q4.10; 2024.q1.1 through 2024.q1.12; 2024.q2.0 through 2024.q2.12; 7.4; 7.4; +34 more |
| CVE-2024-25150 | 4.3 | Feb 20 | Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +25 more |