DX
Product
DXP
243
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 31Medium 204Low 3
Watch
Add DXP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-43748 | 6.8 | Aug 20 | Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9,… Affected: 6.2.0 through portal-173; 7.0.10 through de-102; 7.1.10 through dxp-28; 7.2.10 through dxp-20; 7.3.10 through 7.3.10-u36; 7.4.13 through 7.4.13-u92; +3 more |
| CVE-2025-62258 | 6.5 | Oct 27 | CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and… Affected: 7.3.10 through 7.3.10-u35; 7.4.13 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.4 |
| CVE-2025-62261 | 6.5 | Oct 27 | Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older… Affected: 7.3.10 through 7.3.10-u34; 7.4.13 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.4 |
| CVE-2025-62247 | 6.5 | Oct 22 | Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16,… Affected: 2024.Q1.1 through 2024.Q1.19; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7; 2025.Q1.0 through 2025.Q1.16; 2025.Q2.0 through 2025.Q2.9 |
| CVE-2025-62250 | 6.5 | Oct 21 | Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update… Affected: 7.3.10 through 7.3.10-u35; 7.4.13 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.4; 2023.Q4.0 |
| CVE-2025-62251 | 6.5 | Oct 13 | Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows… Affected: 7.3.10 through 7.3.10-u36; 7.4.13 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.8; 2023.Q4.0 through 2023.Q4.5 |
| CVE-2025-43825 | 6.5 | Oct 3 | A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1… Affected: 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 through 2024.Q4.10; 2024.Q1.1 through 2024.Q1.12; 2024.Q2.1 through 2024.Q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.5; +1 more |
| CVE-2025-43819 | 6.5 | Sep 24 | A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13,… Affected: 2024.Q1.1 through 2024.Q1.12; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.3 |
| CVE-2025-43814 | 6.5 | Sep 22 | In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and… Affected: 7.4.13 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 through 2023.Q4.8 |
| CVE-2025-43798 | 6.5 | Sep 15 | Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be used multiple times… Affected: 7.3.10 through 7.3.10-u35; 7.4.13 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.4; 2023.Q4.0 |
| CVE-2025-43799 | 6.5 | Sep 15 | Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update… Affected: 7.3.10 through 7.3.10-u35; 7.4.13 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.4; 2023.Q4.0 |
| CVE-2025-43784 | 6.5 | Sep 10 | Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.12; 2024.Q2.0 through 2024.Q2.8 |
| CVE-2025-43763 | 6.5 | Sep 8 | A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13,… Affected: 2024.Q1.1 through 2024.Q1.20; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7 |
| CVE-2025-43764 | 6.5 | Aug 23 | Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.20; 2024.Q2.1 through 2024.Q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.1 |
| CVE-2025-43762 | 6.5 | Aug 22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.14; 2024.Q2.0 through 2023.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7; 2025.Q1.0 through 2025.Q1.1 |
| CVE-2025-43752 | 6.5 | Aug 22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.15; 2024Q2.0 through 2023.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7; 2025.Q1.0 through 2025.Q1.4 |
| CVE-2025-43747 | 6.5 | Aug 21 | A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.domain.allowed,… Affected: 2025.Q2.0 through 2025.Q2.3 |
| CVE-2025-43750 | 6.5 | Aug 20 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.14; 2024.Q2.0 through 2023.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7; 2025.Q1.0 through 2025.Q1.1 |
| CVE-2025-43745 | 6.5 | Aug 19 | A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.19; 2024.Q2.0 through 2023.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7; 2025.Q1.0 through 2025.Q1.15; +1 more |
| CVE-2024-26265 | 6.5 | Feb 20 | The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack… Affected: 7.4.13 through 7.4.13.u15; 7.3.10 through 7.3.10-dxp-3; 7.2.10 through 7.2.10-dxp-18 |
| CVE-2024-25604 | 6.5 | Feb 20 | Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions… Affected: 7.4.13; 7.3.10 through 7.3.10-dxp-2; 7.2.10 through 7.2.10-dxp-16 |
| CVE-2024-25144 | 6.5 | Feb 8 | The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and… Affected: 7.4.13 through 7.4.13.u26; 7.3.10 through 7.3.10.u5; 7.2.10 through 7.2.10-dxp-18 |
| CVE-2024-25143 | 6.5 | Feb 7 | The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older… Affected: 7.3.10 through 7.3.10-dxp-2; 7.2.10 through 7.2.10-dxp-12 |
| CVE-2022-38512 | 6.5 | Sep 22 | The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web… Affected: 7.4; 7.4; 7.4; 7.4; 7.4; 7.4; +24 more |
| CVE-2021-29041 | 6.5 | May 16 | Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from… Affected: before 7.3; 7.3 |
| CVE-2025-62267 | 6.1 | Oct 31 | Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through… Affected: 7.4.13-u35 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 through 2023.Q4.10 |
| CVE-2025-62264 | 6.1 | Oct 31 | Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1… Affected: 7.4.13-u4 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 through 2023.Q4.10 |
| CVE-2025-62266 | 6.1 | Oct 30 | By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through… Affected: 7.4.13 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.10; 2023.Q4.0 through 2023.Q4.10; 2024.Q1.1 through 2024.Q1.5 |
| CVE-2025-62253 | 6.1 | Oct 27 | Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through… Affected: 7.3.10 through 7.3.10-u35; 7.4.13 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.4 |
| CVE-2025-62255 | 6.1 | Oct 23 | Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP… Affected: 7.3.10 through 7.3.10-u34; 7.4.13 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.5 |
| CVE-2025-62249 | 6.1 | Oct 21 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12,… Affected: 2023.Q4.0 through 2023.Q4.10; 2024.Q1.1 through 2024.Q1.20; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7; 2025.Q1.0 through 2025.Q1.17; +2 more |
| CVE-2025-43830 | 6.1 | Oct 8 | Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4… Affected: 7.3.10 through 7.3.10-u35; 7.4.13 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.8; 2023.Q4.0 through 2023.Q4.5 |
| CVE-2025-43817 | 6.1 | Sep 29 | Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through… Affected: 7.4.13-u74 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.8; 2023.Q4.0 through 2023.Q4.6 |
| CVE-2025-43818 | 6.1 | Sep 29 | Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through… Affected: 7.3.10-u25 through 7.3.10-u36; 7.4.13-u35 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.6; 2023.Q4.0 through 2023.Q4.4 |
| CVE-2025-43815 | 6.1 | Sep 29 | Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, and… Affected: 2023.Q3.5 through 2023.Q3.6; 2023.Q4.0 through 2023.Q4.2 |
| CVE-2025-43779 | 6.1 | Sep 24 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.18 |
| CVE-2025-43804 | 6.1 | Sep 16 | Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 allows remote… Affected: 2023.Q3.1 through 2023.Q3.4; 2023.Q4.0 through 2023.Q4.1 |
| CVE-2025-43802 | 6.1 | Sep 15 | Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1… Affected: 7.3.10-u33 through 7.3.10-u35; 7.4.13-u51 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.4; 2023.Q4.0 |
| CVE-2025-43800 | 6.1 | Sep 15 | Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7.4 GA through update… Affected: 7.4.13-u20 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.4; 2023.Q4.0 |
| CVE-2025-43791 | 6.1 | Sep 15 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and… Affected: 7.3.10 through 7.3.10-u36; 7.4.13 through 7.4.13-u92; 2023.Q3.1 through 2023.Q3.4; 2023.Q4.0 |
| CVE-2025-43795 | 6.1 | Sep 12 | Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA… Affected: 7.3.10 through 7.3.10-u35; 7.4.13 through 7.4.13-u92; 2023.Q3.0 through 2023.Q3.4 |
| CVE-2025-43783 | 6.1 | Sep 10 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.13-u73 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.12; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.0 through 2024.Q3.1 |
| CVE-2025-43785 | 6.1 | Sep 10 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4… Affected: 7.4.13-u45 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.12; 2024Q2.0 through 2023.Q2.9 |
| CVE-2025-43781 | 6.1 | Sep 9 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13 and… Affected: 2024.Q1.1 through 2024.Q1.12; 2024.Q2.0 through 2023.Q2.13; 2024.Q3.0 through 2024.Q3.8 |
| CVE-2025-43778 | 6.1 | Sep 9 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0… Affected: 2024.Q1.1 through 2024.Q1.20; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.0 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.7; 2025.Q1.0 through 2025.Q1.16; 2025.Q2.0 through 2025.Q2.11 |
| CVE-2025-43765 | 6.1 | Aug 23 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.13; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 |
| CVE-2025-43767 | 6.1 | Aug 23 | Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0… Affected: 7.4.13-u86 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.12; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.1 through 2024.Q3.9 |
| CVE-2025-43769 | 6.1 | Aug 23 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.12; 2024.Q2.0 through 2024.Q2.13; 2024.Q3.1 through 2024.Q3.8 |
| CVE-2025-43770 | 6.1 | Aug 23 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.12; 2024.Q2.0 through 2023.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.3 |
| CVE-2025-43761 | 6.1 | Aug 22 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.13 through 7.4.13-u92; 2024.Q1.1 through 2024.Q1.12; 2024.Q2.0 through 2023.Q2.13; 2024.Q3.1 through 2024.Q3.13; 2024.Q4.0 through 2024.Q4.4 |