Skip to content
OpenAdvisories

Package · Maven

com.liferay:com.liferay.portal.workflow.kaleo.forms.web

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 4.8
    CVE-2025-43778

    Liferay Portal is vulnerable to XSS attack through fieldset name in Kaleo Forms Admin

    A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and …

    Liferay DXP Portal com.liferay:com.liferay.portal.workflow.kaleo.forms.web Maven
  • High 7.1
    CVE-2025-43772

    Liferay Portal Vulnerable to Denial of Service in Kaleo Forms Admin

    Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions does not restrict the saving of request parameters in the portlet session, which allows remote attackers to consume sys…

    Liferay DXP Portal com.liferay:com.liferay.portal.workflow.kaleo.forms.web Maven