Skip to content
OpenAdvisories

Package · Maven

com.liferay.commerce:com.liferay.commerce.service

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2025-43810

    Liferay Portal and DXP allows users to add a note to a different virtual instance

    Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote authenticated user…

    Liferay DXP Portal com.liferay.commerce:com.liferay.commerce.service Maven