DX
Product
DXP
243
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 31Medium 204Low 3
Watch
Add DXP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-43762 | 6.5 | Aug 22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.14; 2024.Q2.0 through 2023.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7; 2025.Q1.0 through 2025.Q1.1 |
| CVE-2025-43752 | 6.5 | Aug 22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.15; 2024Q2.0 through 2023.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7; 2025.Q1.0 through 2025.Q1.4 |
| CVE-2025-43747 | 6.5 | Aug 21 | A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.domain.allowed,… Affected: 2025.Q2.0 through 2025.Q2.3 |
| CVE-2025-43750 | 6.5 | Aug 20 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.14; 2024.Q2.0 through 2023.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7; 2025.Q1.0 through 2025.Q1.1 |
| CVE-2025-43745 | 6.5 | Aug 19 | A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.19; 2024.Q2.0 through 2023.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7; 2025.Q1.0 through 2025.Q1.15; +1 more |
| CVE-2024-26265 | 6.5 | Feb 20 | The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack… Affected: 7.4.13 through 7.4.13.u15; 7.3.10 through 7.3.10-dxp-3; 7.2.10 through 7.2.10-dxp-18 |
| CVE-2024-25604 | 6.5 | Feb 20 | Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions… Affected: 7.4.13; 7.3.10 through 7.3.10-dxp-2; 7.2.10 through 7.2.10-dxp-16 |
| CVE-2024-25144 | 6.5 | Feb 8 | The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and… Affected: 7.4.13 through 7.4.13.u26; 7.3.10 through 7.3.10.u5; 7.2.10 through 7.2.10-dxp-18 |
| CVE-2024-25143 | 6.5 | Feb 7 | The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older… Affected: 7.3.10 through 7.3.10-dxp-2; 7.2.10 through 7.2.10-dxp-12 |
| CVE-2022-38512 | 6.5 | Sep 22 | The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web… Affected: 7.4; 7.4; 7.4; 7.4; 7.4; 7.4; +24 more |
| CVE-2021-29041 | 6.5 | May 16 | Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from… Affected: before 7.3; 7.3 |
| CVE-2025-62267 | 6.1 | Oct 31 | Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through… Affected: 7.4.13-u35 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 through 2023.Q4.10 |
| CVE-2025-62264 | 6.1 | Oct 31 | Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1… Affected: 7.4.13-u4 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 through 2023.Q4.10 |
| CVE-2025-62266 | 6.1 | Oct 30 | By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through… Affected: 7.4.13 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 through 2023.Q4.10; 2024.Q1.1 through 2024.Q1.5 |
| CVE-2025-62253 | 6.1 | Oct 27 | Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through… Affected: 7.3.10 through 7.3.10-u35; 7.4.13 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.4 |
| CVE-2025-62255 | 6.1 | Oct 23 | Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP… Affected: 7.3.10 through 7.3.10-u34; 7.4.13 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.5 |
| CVE-2025-62249 | 6.1 | Oct 21 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12,… Affected: 2023.Q4.0 through 2023.Q4.10; 2024.Q1.1 through 2024.Q1.20; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7; 2025.Q1.0 through 2025.Q1.17; +2 more |
| CVE-2025-43830 | 6.1 | Oct 8 | Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4… Affected: 7.3.10 through 7.3.10-u35; 7.4.13 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.8; 2023.Q4.0 through 2023.Q4.5 |
| CVE-2025-43817 | 6.1 | Sep 29 | Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through… Affected: 7.4.13-u74 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.8; 2023.Q4.0 through 2023.Q4.6 |
| CVE-2025-43818 | 6.1 | Sep 29 | Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through… Affected: 7.3.10-u25 through 7.3.10-u36; 7.4.13-u35 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.6; 2023.Q4.0 through 2023.Q4.4 |
| CVE-2025-43815 | 6.1 | Sep 29 | Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, and… Affected: 2023.Q3.5 through 2023.Q3.6; 2023.Q4.0 through 2023.Q4.2 |
| CVE-2025-43779 | 6.1 | Sep 24 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.18 |
| CVE-2025-43804 | 6.1 | Sep 16 | Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 allows remote… Affected: 2023.Q3.1 through 2023.Q3.4; 2023.Q4.0 through 2023.Q4.1 |
| CVE-2025-43802 | 6.1 | Sep 15 | Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1… Affected: 7.3.10-u33 through 7.3.10-u35; 7.4.13-u51 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.4; 2023.Q4.0 |
| CVE-2025-43800 | 6.1 | Sep 15 | Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7.4 GA through update… Affected: 7.4.13-u20 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.4; 2023.Q4.0 |
| CVE-2025-43791 | 6.1 | Sep 15 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and… Affected: 7.3.10 through 7.3.10-u36; 7.4.13 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.4; 2023.Q4.0 |
| CVE-2025-43795 | 6.1 | Sep 12 | Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA… Affected: 7.3.10 through 7.3.10-u35; 7.4.13 through 7.4.13-u92; 2023.Q3.0 through 2023.Q3.4 |
| CVE-2025-43783 | 6.1 | Sep 10 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.13-u73 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.12; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.0 through 2024.Q3.1 |
| CVE-2025-43785 | 6.1 | Sep 10 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4… Affected: 7.4.13-u45 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.12; 2024Q2.0 through 2023.Q2.9 |
| CVE-2025-43781 | 6.1 | Sep 9 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13 and… Affected: 2024.Q1.1 through 2024.Q1.12; 2024.Q2.0 through 2023.Q2.13; 2024.Q3.0 through 2024.Q3.8 |
| CVE-2025-43778 | 6.1 | Sep 9 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0… Affected: 2024.Q1.1 through 2024.Q1.20; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7; 2025.Q1.0 through 2025.Q1.16; 2025.Q2.0 through 2025.Q2.11 |
| CVE-2025-43765 | 6.1 | Aug 23 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.13; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 |
| CVE-2025-43767 | 6.1 | Aug 23 | Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0… Affected: 7.4.13-u86 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.12; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.1 through 2024.Q3.9 |
| CVE-2025-43769 | 6.1 | Aug 23 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.12; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.1 through 2024.Q3.8 |
| CVE-2025-43770 | 6.1 | Aug 23 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.12; 2024.Q2.0 through 2023.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.3 |
| CVE-2025-43761 | 6.1 | Aug 22 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.12; 2024.Q2.0 through 2023.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.4 |
| CVE-2025-43742 | 6.1 | Aug 20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.14; 2024.Q2.0 through 2023.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7; 2025.Q1.0 through 2025.Q1.3 |
| CVE-2025-43735 | 6.1 | Aug 12 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.12; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7 |
| CVE-2025-4576 | 6.1 | Aug 8 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.15; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7; 2025.Q1.0 through 2025.Q1.4 |
| CVE-2025-4604 | 6.1 | Aug 4 | The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.13-u80 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.16; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7; 2025.Q1.0 through 2025.Q1.15 |
| CVE-2025-4599 | 6.1 | Aug 4 | The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through… Affected: 7.4.13-u61 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.13; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.5 |
| CVE-2025-4388 | 6.1 | May 6 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.12; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.5 |
| CVE-2025-2536 | 6.1 | Mar 19 | Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12,… Affected: 7.4.13-u82 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 through 2023.Q4.10; 2024.Q1.1 through 2024.Q1.12; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.0 |
| CVE-2024-11993 | 6.1 | Dec 17 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary… Affected: 7.4.13 through 7.4.13-u38 |
| CVE-2024-8980 | 6.1 | Oct 22 | The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix… Affected: 6.2.0 through portal-173; 7.0.10 through de-102; 7.1.10 through dxp-28; 7.2.10 through dxp-20; 7.3.10 through 7.3.10-u35; 7.4.13 through 7.4.13-u92; +1 more |
| CVE-2023-40191 | 6.1 | Feb 21 | Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and… Affected: 2023.q3.1 through 2023.q3.5; 7.4.13.u44 through 7.4.13.u92 |
| CVE-2023-42498 | 6.1 | Feb 21 | Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4… Affected: 2023.q3.1 through 2023.q3.4; 7.4.13.u4 through 7.4.13.u92 |
| CVE-2024-26269 | 6.1 | Feb 21 | Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update… Affected: 7.4.13 through 7.4.13.u37; 7.3.10 through 7.3.10.u10; 7.2.10 through 7.2.10-dxp-19 |
| CVE-2023-42496 | 6.1 | Feb 21 | Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA… Affected: 2023.q3.1 through 2023.q3.5; 7.4.13 through 7.4.13.u92; 7.3.10 through 7.3.10-dxp-33 |
| CVE-2024-25147 | 6.1 | Feb 21 | Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3,… Affected: 7.3.10 through 7.3.10-dxp-2; 7.2.10 through 7.2.10-dxp-14 |