DE
Product
Digital Experience Platform
264
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 35Medium 224Low 2
Watch
Add Digital Experience Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-43827 | 4.3 | Sep 30 | Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1… Affected: through 7.3; 2023.Q3.1 through 2023.Q3.10; 2023.q4.0 through 2023.q4.10; 2024.Q1.1 before 2024.Q1.6; 7.4 |
| CVE-2025-43810 | 4.3 | Sep 22 | Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 before 2023.Q4.9; 7.4; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-43806 | 4.3 | Sep 22 | Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 does not properly… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 before 2023.Q4.8; 7.4; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-43809 | 4.3 | Sep 19 | Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay… Affected: through 7.4; 2023.q3.1 before 2023.q3.9; 2023.Q4.0 before 2023.Q4.8 |
| CVE-2025-43803 | 4.3 | Sep 19 | Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP… Affected: through 7.3; 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 before 2023.Q4.7; 7.4; 7.4; 7.4; +34 more |
| CVE-2025-43788 | 4.3 | Sep 12 | The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user… Affected: 2024.Q1.1 before 2024.Q1.13; 7.4; 7.4; 7.4; 7.4; 7.4 |
| CVE-2025-43782 | 4.3 | Sep 11 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7, 2024.Q1.1 through 2024.Q1.12, and 7.4… Affected: 2024.Q1.1 before 2024.Q1.13; 2024.Q2.0 before 2024.Q2.8; 7.4 |
| CVE-2025-43743 | 4.3 | Aug 19 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 2024.Q1.1 before 2024.Q1.16; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7; 2025.Q1.0 before 2025.Q1.6; 7.4; +34 more |
| CVE-2025-43739 | 4.3 | Aug 19 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 2024.q1.1 through 2024.q1.19; 2024.q2.0 through 2024.q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7; 2025.Q1.0 before 2025.Q1.7; 7.4; +34 more |
| CVE-2025-43736 | 4.3 | Aug 12 | A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7,… Affected: 2024.q1.1 through 2024.q1.16; 2024.Q2.1 through 2024.Q2.13; 2024.q3.1 through 2024.q3.13; 2024.q4.0 through 2024.q4.7; 2025.q1.0 through 2025.q1.8; 7.4 |
| CVE-2025-2565 | 4.3 | Mar 20 | The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.q4.0 through 2023.q4.10; 2024.q1.1 through 2024.q1.12; 2024.q2.0 through 2024.q2.12; 7.4; 7.4; +34 more |
| CVE-2024-25150 | 4.3 | Feb 20 | Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before… Affected: before 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +25 more |
| CVE-2023-3426 | 4.3 | Aug 2 | The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated… Affected: 7.4; 7.4; 7.4; 7.4; 7.4 |
| CVE-2023-33947 | 4.3 | May 24 | The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows… Affected: 7.4; 7.4; 7.4; 7.4; 7.4; 7.4; +34 more |
| CVE-2023-33946 | 4.3 | May 24 | The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows… Affected: 7.4; 7.4; 7.4; 7.4; 7.4; 7.4; +34 more |
| CVE-2022-42126 | 4.3 | Nov 15 | The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset… Affected: 7.3; 7.4; 7.4 |
| CVE-2022-42129 | 4.3 | Nov 15 | An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4… Affected: 7.3; 7.4 |
| CVE-2022-42130 | 4.3 | Nov 15 | The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not… Affected: 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; +34 more |
| CVE-2022-26595 | 4.3 | Apr 19 | Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which… Affected: 7.2; 7.3 |
| CVE-2021-33334 | 4.3 | Aug 3 | The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2021-33330 | 4.3 | Aug 3 | Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only… Affected: 7.2; 7.2; 7.2; 7.2; 7.2; 7.2; +3 more |
| CVE-2021-33327 | 4.3 | Aug 3 | The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly… Affected: 7.0; 7.0; 7.1; 7.2; 7.2; 7.2; +5 more |
| CVE-2021-33324 | 4.3 | Aug 3 | The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which… Affected: 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; +19 more |
| CVE-2021-33320 | 4.3 | Aug 3 | The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit the rate at which… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |