LP
Product
Liferay Portal
On CISA KEVExploited in the wild
319
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 47Medium 255Low 2
Watch
Add Liferay Portal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-7961 In wildKEV | 9.8 | Mar 20 | Liferay Portal Deserialization of Untrusted Data Vulnerability Affected: before 7.2.1 |
| CVE-2025-43766 | 9.8 | Aug 23 | The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through… Affected: 7.4.0 before 7.4.3.132 |
| CVE-2025-3594 | 9.8 | Jun 16 | Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 34, and older… Affected: 7.0.0 through 7.4.3.4; 6.2 |
| CVE-2021-33990 | 9.8 | Apr 16 | Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists Affected: 6.2.5 |
| CVE-2022-42122 | 9.8 | Nov 15 | A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL… Affected: 7.3.7 |
| CVE-2022-42120 | 9.8 | Nov 15 | A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to… Affected: 7.3.3 through 7.4.3.16 |
| CVE-2019-16891 | 9.8 | Oct 4 | Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload Affected: through 6.0.6; 6.1.0; 6.1.0; 6.1.0; 6.1.0; 6.1.0; +34 more |
| CVE-2025-43773 | 9.1 | Aug 29 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2024-38002 | 8.8 | Oct 22 | The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA… Affected: 7.3.2 through 7.3.7; 7.4.0 before 7.4.3.112 |
| CVE-2024-26273 | 8.8 | Oct 22 | Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1… Affected: 7.4.0 before 7.4.3.104 |
| CVE-2024-26272 | 8.8 | Oct 22 | Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1… Affected: 7.3.2 through 7.3.7; 7.4.0 before 7.4.3.108 |
| CVE-2024-26271 | 8.8 | Oct 22 | Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1… Affected: 7.4.3.75 before 7.4.3.112 |
| CVE-2023-35030 | 8.8 | Jun 15 | Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76… Affected: 7.4.3.70 before 7.4.3.77 |
| CVE-2022-42121 | 8.8 | Nov 15 | A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack… Affected: 7.1.3 through 7.4.3.4; 7.1.0 through 7.4.2 |
| CVE-2021-29053 | 8.8 | May 17 | Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the… Affected: 7.3.5 |
| CVE-2020-15841 | 8.8 | Jul 20 | Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which… Affected: before 7.3.0 |
| CVE-2020-13445 | 8.8 | Jun 10 | In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to… Affected: 7.1; 7.1; 7.1; 7.1.1; 7.2; 7.3; +1 more |
| CVE-2018-10795 | 8.8 | May 7 | Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the… Affected: through 6.2.5 |
| CVE-2010-5327 | 8.8 | Jan 13 | Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template Affected: through 6.2.10 |
| CVE-2024-25606 | 8.7 | Feb 20 | XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and… Affected: before 7.4.3.8 |
| CVE-2025-4581 | 8.6 | Aug 9 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43813 | 8.2 | Sep 29 | Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP… Affected: 7.3.0 through 7.3.7; 7.4.0 before 7.4.3.108 |
| CVE-2025-43790 | 8.1 | Sep 11 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4… Affected: 7.4.0 before 7.4.3.124 |
| CVE-2024-25148 | 8.1 | Feb 8 | In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the… Affected: 7.2.0 through 7.4.1 |
| CVE-2023-33945 | 8.1 | May 24 | SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows… Affected: 7.3.1 through 7.3.7; 7.4.0 through 7.4.3.17 |
| CVE-2020-15842 | 8.1 | Jul 20 | Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary… Affected: before 7.3.0 |
| CVE-2025-43768 | 7.7 | Aug 23 | Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and… Affected: 7.4.0 before 7.4.3.132 |
| CVE-2025-62260 | 7.5 | Oct 27 | Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not… Affected: 7.4.0 before 7.4.3.99 |
| CVE-2025-62254 | 7.5 | Oct 23 | The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA… Affected: 7.4.0 through 7.4.3.111 |
| CVE-2025-43816 | 7.5 | Sep 25 | A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5,… Affected: before 7.4.3.120 |
| CVE-2025-43801 | 7.5 | Sep 16 | Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through… Affected: before 7.4.3.112 |
| CVE-2025-43793 | 7.5 | Sep 15 | Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35,… Affected: before 7.4.3.106 |
| CVE-2025-43796 | 7.5 | Sep 12 | Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects… Affected: 7.4.0 before 7.4.3.102 |
| CVE-2025-3526 | 7.5 | Jun 16 | SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsupported versions does not restrict the… Affected: 7.0.0 through 7.4.3.21; 6.2 |
| CVE-2025-3602 | 7.5 | Jun 16 | Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does… Affected: 7.4.0 through 7.4.3.97 |
| CVE-2024-25607 | 7.5 | Feb 20 | The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3… Affected: through 7.4.3.15 |
| CVE-2023-33950 | 7.5 | May 24 | Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used… Affected: 7.4.3.48 through 7.4.3.76 |
| CVE-2023-33949 | 7.5 | May 24 | In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers… Affected: 7.0.0 through 7.0.6; 7.1.0 through 7.1.3; 7.2.0 through 7.2.1; 7.3.0 |
| CVE-2023-33948 | 7.5 | May 24 | The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows… Affected: 7.4.3.67 |
| CVE-2022-42123 | 7.5 | Nov 15 | A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19 allows attackers to… Affected: 7.3.3 before 7.4.3.19 |
| CVE-2022-42125 | 7.5 | Nov 15 | Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing… Affected: 7.4.3.5 before 7.4.3.36 |
| CVE-2022-42124 | 7.5 | Nov 15 | ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and… Affected: 7.3.2 before 7.4.3.5 |
| CVE-2022-28981 | 7.5 | Sep 22 | Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of… Affected: 7.4.0 through 7.4.2 |
| CVE-2021-38266 | 7.5 | Mar 2 | The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import… Affected: through 7.2.1 |
| CVE-2021-33338 | 7.5 | Aug 4 | The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows… Affected: 7.1.0 through 7.3.2 |
| CVE-2021-33323 | 7.5 | Aug 3 | The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated… Affected: 7.1.0 before 7.3.1 |
| CVE-2021-33322 | 7.5 | Aug 3 | In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a… Affected: before 7.3.1 |
| CVE-2021-33321 | 7.5 | Aug 3 | Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password… Affected: 6.2.3 before 7.3.3 |
| CVE-2021-29047 | 7.5 | May 16 | The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote… Affected: 7.3.4; 7.3.5 |
| CVE-2020-24554 | 7.5 | Sep 1 | The redirect module in Liferay Portal before 7.3.3 does not limit the number of URLs resulting in a 404 error that is recorded, which allows remote attackers to perform a denial… Affected: before 7.3.3 |