LP
Product
Liferay Portal
On CISA KEVExploited in the wild
319
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 47Medium 255Low 2
Watch
Add Liferay Portal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-43785 | 6.1 | Sep 10 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4… Affected: 7.4.3.45 before 7.4.3.129 |
| CVE-2025-43781 | 6.1 | Sep 9 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13 and… Affected: 7.4.0 before 7.4.3.129 |
| CVE-2025-43778 | 6.1 | Sep 9 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43765 | 6.1 | Aug 23 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.0 before 7.4.3.132 |
| CVE-2025-43767 | 6.1 | Aug 23 | Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0… Affected: 7.4.3.86 before 7.4.3.132 |
| CVE-2025-43769 | 6.1 | Aug 23 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1… Affected: 7.4.0 before 7.4.3.132 |
| CVE-2025-43770 | 6.1 | Aug 23 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.0 before 7.4.3.132 |
| CVE-2025-43761 | 6.1 | Aug 22 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.0 before 7.4.3.132 |
| CVE-2025-43742 | 6.1 | Aug 20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.0 through 7.4.3.132 |
| CVE-2025-43735 | 6.1 | Aug 12 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.0 through 7.4.3.131 |
| CVE-2025-4576 | 6.1 | Aug 8 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7,… Affected: 7.4.0 through 7.4.3.133 |
| CVE-2025-4604 | 6.1 | Aug 4 | The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13,… Affected: 7.4.3.80 through 7.4.3.132 |
| CVE-2025-4599 | 6.1 | Aug 4 | The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through… Affected: 7.4.3.61 before 7.4.3.132 |
| CVE-2025-4388 | 6.1 | May 6 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13,… Affected: 7.4.0 before 7.4.3.132 |
| CVE-2025-2536 | 6.1 | Mar 19 | Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12,… Affected: 7.4.3.82 through 7.4.3.128 |
| CVE-2024-11993 | 6.1 | Dec 17 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary… Affected: 7.1.0 before 7.4.3.39 |
| CVE-2024-8980 | 6.1 | Oct 22 | The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix… Affected: 7.0.0 before 7.0.6; 7.1.0 before 7.1.3; 7.2.0 through 7.2.1; 7.3.0 through 7.3.7; 7.4.0 before 7.4.3.102 |
| CVE-2023-40191 | 6.1 | Feb 21 | Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and… Affected: 7.4.3.44 before 7.4.3.98 |
| CVE-2023-42498 | 6.1 | Feb 21 | Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4… Affected: 7.4.3.8 before 7.4.3.98 |
| CVE-2024-26269 | 6.1 | Feb 21 | Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update… Affected: 7.2.0 before 7.4.3.38 |
| CVE-2023-42496 | 6.1 | Feb 21 | Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA… Affected: 7.3.3 before 7.4.3.98 |
| CVE-2024-25147 | 6.1 | Feb 21 | Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3,… Affected: before 7.4.2 |
| CVE-2024-25609 | 6.1 | Feb 20 | HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through… Affected: before 7.4.3.13 |
| CVE-2024-25608 | 6.1 | Feb 20 | HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack… Affected: before 7.4.3.19 |
| CVE-2023-5190 | 6.1 | Feb 20 | Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45… Affected: 7.4.3.45 before 7.4.3.102 |
| CVE-2023-47797 | 6.1 | Nov 17 | Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script… Affected: 7.4.3.94 through 7.4.3.95 |
| CVE-2023-44311 | 6.1 | Oct 17 | Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through… Affected: 7.4.3.41 before 7.4.3.90 |
| CVE-2023-42497 | 6.1 | Oct 17 | Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows… Affected: 7.4.3.4 before 7.4.3.86 |
| CVE-2023-35029 | 6.1 | Jun 15 | Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers… Affected: 7.4.3.70 before 7.4.3.77 |
| CVE-2023-3193 | 6.1 | Jun 15 | Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows… Affected: 7.4.3.70 before 7.4.3.74 |
| CVE-2023-33944 | 6.1 | May 24 | Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote… Affected: 7.3.4 through 7.3.7 |
| CVE-2023-33941 | 6.1 | May 24 | Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and… Affected: 7.4.3.41 through 7.4.3.52 |
| CVE-2023-33938 | 6.1 | May 24 | Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows… Affected: 7.3.0 through 7.3.7; 7.4.0 |
| CVE-2022-42118 | 6.1 | Nov 15 | A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and… Affected: 7.1.0 through 7.4.2 |
| CVE-2022-42110 | 6.1 | Nov 14 | A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and… Affected: 7.1.0 through 7.4.2 |
| CVE-2022-42117 | 6.1 | Oct 18 | A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17… Affected: 7.3.2 through 7.4.3.16 |
| CVE-2022-42116 | 6.1 | Oct 18 | A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6,… Affected: 7.3.2 before 7.4.3.15 |
| CVE-2022-42113 | 6.1 | Oct 18 | A Cross-site scripting (XSS) vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote… Affected: 7.4.3.30 before 7.4.3.37 |
| CVE-2022-28980 | 6.1 | Sep 22 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters… Affected: before 7.4.3.5 |
| CVE-2022-28977 | 6.1 | Sep 22 | HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before… Affected: 7.3.1 before 7.4.3.4 |
| CVE-2022-28982 | 6.1 | Sep 21 | A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or… Affected: 7.3.3 before 7.4.3.4 |
| CVE-2022-28979 | 6.1 | Sep 21 | Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting… Affected: 7.1.0 before 7.4.3.4 |
| CVE-2022-26596 | 6.1 | Apr 25 | Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94,… Affected: 7.1.0 through 7.3.3 |
| CVE-2022-26597 | 6.1 | Apr 25 | Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows… Affected: 7.3.0 through 7.4.0 |
| CVE-2022-26594 | 6.1 | Apr 15 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web… Affected: 7.3.5 before 7.3.7; 7.4.0 |
| CVE-2021-38263 | 6.1 | Mar 2 | Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20… Affected: through 7.3.2 |
| CVE-2021-38264 | 6.1 | Mar 2 | Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the… Affected: 7.4.0; 7.4.1 |
| CVE-2021-35463 | 6.1 | Aug 4 | Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management… Affected: 7.4.0 |
| CVE-2021-33337 | 6.1 | Aug 4 | Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2… Affected: 7.3.0 through 7.3.4 |
| CVE-2021-33332 | 6.1 | Aug 3 | Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack… Affected: 7.1.0 before 7.3.3 |