Skip to content
OpenAdvisories

Ecosystem

Maven

7,126 known vulnerabilities.

Most affected packages

org.jenkins-ci.main:jenkins-core 259 org.apache.tomcat:tomcat 168 com.liferay.portal:release.portal.bom 159 com.liferay.portal:release.dxp.bom 125 org.keycloak:keycloak-services 104 com.fasterxml.jackson.core:jackson-databind 86 org.apache.tomcat.embed:tomcat-embed-core 82 org.apache.struts:struts2-core 60 org.keycloak:keycloak-core 49 org.xwiki.platform:xwiki-platform-oldcore 46 org.apache.tomcat:tomcat-catalina 44 io.undertow:undertow-core 42 org.elasticsearch:elasticsearch 40 net.mingsoft:ms-mcms 39 com.thoughtworks.xstream:xstream 37 org.jenkins-ci.plugins:script-security 37 com.jfinal:jfinal 36 org.apache.tomcat:tomcat-coyote 34 org.apache.solr:solr-core 31 org.springframework.security:spring-security-core 31 org.opencms:opencms-core 31 org.eclipse.jetty:jetty-server 29 org.springframework:spring-webmvc 27 org.bouncycastle:bcprov-jdk14 26 org.keycloak:keycloak-parent 26 org.bouncycastle:bcprov-jdk15on 25 org.apache.openmeetings:openmeetings-parent 25 io.netty:netty-codec-http 24 org.apache.activemq:apache-activemq 23 org.xwiki.platform:xwiki-platform-web-templates 23 org.apache.nifi:nifi 21 org.cloudfoundry.identity:cloudfoundry-identity-server 21 org.apache.activemq:activemq-client 20 org.springframework:spring-webflux 20 org.springframework:spring-core 19 com.liferay.portal:com.liferay.portal.impl 18 org.asynchttpclient:async-http-client 18 com.vaadin:vaadin-bom 18 org.apache.jspwiki:jspwiki-main 18 org.apache.activemq:activemq-all 17
All Critical High Medium Low Exploited only Public exploit

3,448 results · Clear filters · Feed

  • Medium 4.6
    CVE-2025-43773

    Liferay Portal allows improper access through the expandoTableLocalService

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 has a security …

    Liferay DXP Portal com.liferay:com.liferay.portal.workflow.kaleo.runtime.impl Maven
  • Medium 5.8
    CVE-2025-58049

    XWiki PDF export jobs store sensitive cookies unencrypted in job statuses

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookie…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-export-pdf-api Maven
  • Medium 6.9
    CVE-2025-43764

    Liferay Portal ReDoS with Role Name search in KaleoDesignerPortlet

    Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.1, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2…

    Liferay DXP Portal com.liferay:com.liferay.portal.workflow.kaleo.designer.web Maven
  • Medium 6.9
    CVE-2025-43765

    Liferay Portal stored cross-site scripting in text field of the web content structure

    A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 GA through update 92 allows an remote non-au…

    Liferay DXP Portal com.liferay:com.liferay.journal.service Maven
  • Medium 6.8
    CVE-2025-43766

    Liferay Portal allows unrestricted upload of file in the style books component

    The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows the upload of unrestricted files in the style books component t…

    Liferay DXP Portal com.liferay:com.liferay.style.book.web Maven
  • Medium 5.1
    CVE-2025-43767

    Liferay Portal allows open redirect in /c/portal/edit_info_item parameter redirect

    Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 update 86 through update 9…

    Liferay DXP Portal com.liferay:com.liferay.info.impl Maven
  • Medium 5.1
    CVE-2025-43768

    Liferay Portal JSONWS API endpoint shares sensitive information

    Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows authenticated users without any permissions to ac…

    Liferay DXP Portal com.liferay.portal:com.liferay.portal.impl Maven
  • Medium 4.6
    CVE-2025-43769

    Liferay Portal vulnerable to Stored XSS in Components portlet

    Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute …

    Liferay DXP Portal com.liferay:com.liferay.plugins.admin.web Maven
  • Medium 6.9
    CVE-2025-43770

    Liferay Portal vulnerable to Reflected XSS with the referer and forward parameter

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update…

    Liferay DXP Portal com.liferay.portal:com.liferay.portal.kernel Maven
  • Medium 6.9
    CVE-2025-43761

    Liferay Portal Reflected XSS in CKeditor 4.21.0 endpoint

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update…

    Liferay DXP Portal com.liferay:com.liferay.frontend.editor.ckeditor.web npm Maven
  • Medium 6.7
    CVE-2025-43759

    Liferay Portal users are able to add system admin portlets to pages

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows admin users of a virtual instance to a…

    Liferay DXP Portal com.liferay:com.liferay.layout.impl Maven
  • Medium 5.3
    CVE-2025-43762

    Liferay Portal users can upload an unlimited amount of files

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allow users to upload an un…

    Liferay DXP Portal com.liferay:com.liferay.dynamic.data.mapping.form.field.type Maven
  • Medium 5.3
    CVE-2025-43758

    Liferay Portal's unauthenticated users can access loaded files via URL before submitting the object entry

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows unauthenticated user…

    Liferay DXP Portal com.liferay:com.liferay.frontend.js.web Maven
  • Medium 5.3
    CVE-2025-43760

    Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 6.9
    CVE-2025-43751

    Liferay Portal User Enumeration Vulnerability via the Create Account Page

    User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 20…

    Liferay DXP Portal com.liferay:com.liferay.login.web Maven
  • Medium 5.9
    CVE-2025-9341

    Garbage collection can delay for AES CBC Native support, resulting in heap exhaustion

    Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows Excessive Alloc…

    Legion of the Bouncy Castle Bouncy Castle for Java LTS Bouncy Castle for Java FIPS org.bouncycastle:bc-fips Maven
  • Medium 5.3
    CVE-2025-43752

    Liferay Portal's Unlimited File Upload Could Result in DoS

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allow users to upload an un…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 6.5
    CVE-2025-51825

    JeecgBoot SQL Injection Vulnerability

    JeecgBoot versions from 3.4.3 up to 3.8.0 were found to contain a SQL injection vulnerability in the /jeecg-boot/online/cgreport/head/parseSql endpoint, which allows bypassing SQL blacklist restrictions.

    org.jeecgframework.boot:jeecg-boot-base-core Maven
  • Medium 6.9
    CVE-2025-43754

    Liferay Portal Username Enumeration Vulnerability

    Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers t…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.1
    CVE-2025-43755

    Liferay Portal Stored Cross-Site Scripting Vulnerability via GroupPagesPortlet_type Parameter

    A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.13, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 20…

    Liferay DXP Portal com.liferay:com.liferay.layout.admin.web Maven
  • Medium 6.9
    CVE-2025-43756

    Liferay Portal Reflected Cross-Site Scripting Vulnerability via snippet Parameter

    <!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}-->A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.15, 2025.Q2.0 through 2025.Q2.2 and 2024.Q1.13 through 2024…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 4.9
    CVE-2025-9162

    Org.keycloak/keycloak-model-storage-service: variable injection into environment variables

    A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection at…

    Red Hat Keycloak Red Hat build of Keycloak 26.2 Red Hat build of Keycloak 26.0 Maven
  • Medium 5.4
    CVE-2025-9264

    Xuxueli xxl-job Jobs JobInfoController.java remove resource injection

    A vulnerability was found in Xuxueli xxl-job up to 3.1.1. Affected by this issue is the function remove of the file /src/main/java/com/xxl/job/admin/controller/JobInfoController.java of the component Jobs Handler. Performing manipulation of the argument ID re…

    xuxueli xxl-job com.xuxueli:xxl-job-admin Maven
  • Medium 4.3
    CVE-2025-9263

    Xuxueli xxl-job JobLogController.java getJobsByGroup resource injection

    A vulnerability has been found in Xuxueli xxl-job up to 3.1.1. Affected by this vulnerability is the function getJobsByGroup of the file /src/main/java/com/xxl/job/admin/controller/JobLogController.java. Such manipulation of the argument jobGroup leads to imp…

    xuxueli xxl-job com.xuxueli:xxl-job-admin Maven
  • Medium 4.8
    CVE-2025-43757

    Liferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition Parameter

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.1
    CVE-2025-43746

    Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.3
    CVE-2025-43749

    Liferay Portal Unauthenticated File Access via URL

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated user…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.1
    CVE-2025-43750

    Liferay Portal Unvalidated File Upload

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows remote unauthenticat…

    Liferay DXP Portal com.liferay:com.liferay.dynamic.data.mapping.form.web Maven
  • Medium 5.1
    CVE-2025-43741

    Liferay Portal Vulnerable to Cross-Site Scripting via assetTagNames Parameter

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 6.9
    CVE-2025-43742

    Liferay Portal Vulnerable to Cross-Site Scripting through URLs

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1…

    Liferay DXP Portal com.liferay:com.liferay.layout.type.controller.display.page Maven
  • Medium 6.3
    CVE-2024-39954

    Apache EventMesh Runtime: SSRF

    CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version…

    Apache Software Foundation Apache EventMesh Runtime org.apache.eventmesh:eventmesh-runtime Maven
  • Medium 5.1
    CVE-2025-43744

    Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels

    A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.3
    CVE-2025-43743

    Liferay Portal Enumeration Discrepancy in Calendars

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated re…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 6.9
    CVE-2025-43745

    Liferay Portal CSRF Vulnerability via Endpoint Parameter

    A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 an…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.1
    CVE-2025-43737

    Liferay Portal Vulnerable to Cross-Site Scripting via backURL Paramter

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote authenticated user to inject JavaScript code via _com_liferay_journal_web_portle…

    Liferay DXP Portal com.liferay:com.liferay.journal.web Maven
  • Medium 5.1
    CVE-2025-43738

    Liferay Portal Reflected Cross-Site Scripting Vulnerability in displayType Parameter

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2…

    Liferay DXP Portal com.liferay:com.liferay.expando.web Maven
  • Medium 5.3
    CVE-2025-43739

    Liferay Portal Email Modification Vulnerability via Calendar Portlet

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allow any authenticated use…

    Liferay DXP Portal com.liferay:com.liferay.calendar.service Maven
  • Medium 4.6
    CVE-2025-43740

    Liferay Portal has Stored Cross-Site Scripting Vulnerability via Message Boards Feature

    A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 a…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 6.9
    CVE-2025-43731

    Liferay Portal Vulnerable to Cross-Site Scripting

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 4.8
    CVE-2025-43732

    Liferay Portal Vulnerable to Insecure Direct Object Reference

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 is vulnerable to Insecure …

    Liferay DXP Portal com.liferay:com.liferay.roles.selector.web Maven