LP
Product
Liferay Portal
On CISA KEVExploited in the wild
319
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 47Medium 255Low 2
Watch
Add Liferay Portal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-7961 In wildKEV | 9.8 | Mar 20 | Liferay Portal Deserialization of Untrusted Data Vulnerability Affected: before 7.2.1 |
| CVE-2025-43766 | 9.8 | Aug 23 | The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through… Affected: 7.4.0 before 7.4.3.132 |
| CVE-2025-3594 | 9.8 | Jun 16 | Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 34, and older… Affected: 7.0.0 through 7.4.3.4; 6.2 |
| CVE-2021-33990 | 9.8 | Apr 16 | Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists Affected: 6.2.5 |
| CVE-2022-42122 | 9.8 | Nov 15 | A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL… Affected: 7.3.7 |
| CVE-2022-42120 | 9.8 | Nov 15 | A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to… Affected: 7.3.3 through 7.4.3.16 |
| CVE-2019-16891 | 9.8 | Oct 4 | Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload Affected: through 6.0.6; 6.1.0; 6.1.0; 6.1.0; 6.1.0; 6.1.0; +34 more |
| CVE-2025-43773 | 9.1 | Aug 29 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through… Affected: 7.4.0 through 7.4.3.132 |
Showing 8