Skip to content
OpenAdvisories

Vendor

Liferay

210 known vulnerabilities.

Liferay at a glance

Last 12 months
0
Critical · all time
23
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202510
Oct 2025400
Sep 2025500
Aug 2025460
Jul 202500
Jun 202530
May 202510
Apr 202510
Mar 202520
Feb 202500
Jan 202500
Dec 202420

Products

DXP 209 Portal 206 Liferay DXP < 7.4 update 86 0 Liferay Portal < 7.4.3.86 0 Liferay Portal < 7.4.3.96 0 Liferay DXP < 7.4 update 88 0 Liferay DXP < 7.4 update 54 0 Liferay DXP < 7.3 update 24 0 Liferay DXP < 7.4 update 90 0 Liferay DXP < 7.4 update 79 0 Liferay Portal < 7.4.3.54 0 Liferay Portal < 7.4.3.88 0 Liferay Portal < 7.4.3.79 0 Liferay Portal < 7.4.3.90 0 Liferay DXP < 7.4 update 92 0 Liferay Portal < 7.4.3.92 0 Liferay Portal 0

Latest advisories

  • Medium max 7.5
    WID-SEC-2025-1940 1 CVE rev. 2

    Liferay Portal: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode

    Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Liferay Portal und Liferay DXP ausnutzen, um beliebigen Programmcode auszuführen.

    Liferay Linux Windows macOS
    first Sep 1, 2025
  • High max 9.6
    WID-SEC-2025-2626 1 CVE

    Liferay Portal und DXP: Schwachstelle ermöglicht Cross-Site Scripting

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Liferay Portal und Liferay DXP ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

    Liferay
  • Medium max 6.9
    WID-SEC-2025-2470 4 CVEs

    Liferay Portal und DXP: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um einen Cross-Site-Scripting-Angriff durchzuführen, Informationen einzusehen oder Daten zu manipulieren.

    Liferay Linux Windows macOS
  • Medium max 5.1
    WID-SEC-2025-2455 2 CVEs

    Liferay Portal: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, und um falsche Informationen darzustellen.

    Liferay Linux
  • Medium max 6.3
    WID-SEC-2025-2446 1 CVE

    Liferay Portal und DXP: Schwachstelle ermöglicht Offenlegung von Informationen

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Liferay Portal und Liferay DXP ausnutzen, um Informationen offenzulegen.

    Liferay Linux
All Critical High Medium Low Exploited only Public exploit

210 results · Feed

  • Medium 6.9
    CVE-2025-62275

    Liferay Portal and DXP do not check permissions of images in a blog entry

    Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog…

    Liferay DXP Portal com.liferay:com.liferay.blogs.item.selector.web Maven
  • Medium 4.6
    CVE-2025-62276

    Liferay Portal and DXP use an incorrect cache-control header

    The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions…

    Liferay DXP Portal com.liferay.portal:com.liferay.portal.impl Maven
  • Medium 4.6
    CVE-2025-62267

    Liferay Portal and DXP affected by multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page

    Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 35 through update 92 allow…

    Liferay DXP Portal com.liferay:com.liferay.dynamic.data.mapping.item.selector.web Maven
  • Medium 5.1
    CVE-2025-62264

    Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter

    Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92 allows remote attackers to inj…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 4.8
    CVE-2025-62265

    Liferay Portal is vulnerable to XSS in the Blogs widget

    Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update …

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.1
    CVE-2025-62266

    Liferay Portal is vulnerable to DNS rebinding attacks

    By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 6.3
    CVE-2025-62257

    Liferay Portal vulnerable to password enumeration

    Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsuppor…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • High 7.0
    CVE-2025-62258

    Liferay Portal Vulnerable to CSRF in Headless APIs

    CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API v…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 6.9
    CVE-2025-62259

    Liferay Portal Does Not Limit Access to APIs Before Email Verification

    Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified th…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • High 7.1
    CVE-2025-62260

    Liferay Portal Vulnerable to DoS via Crafted Headless API Request

    Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remot…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 6.9
    CVE-2025-62261

    Liferay Portal Stores Password Reset Tokens in Plain Text

    Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows att…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 4.6
    CVE-2025-62262

    Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature

    Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older uns…

    Liferay DXP Portal com.liferay:com.liferay.portal.security.ldap.impl Maven
  • Medium 4.8
    CVE-2025-62263

    Liferay Portal Vulnerable to Cross-Site Scripting

    Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 service pack 3 through update 36 allow remote attackers to inject arbitrary web script or…

    Liferay DXP Portal com.liferay:com.liferay.account.admin.web Maven
  • Medium 6.9
    CVE-2025-62253

    Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter

    Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported vers…

    Liferay DXP Portal com.liferay:com.liferay.layout.admin.web Maven
  • Medium 6.9
    CVE-2025-62254

    Liferay Portal ComboServlet denial of service via large file combination

    The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not l…

    Liferay DXP Portal com.liferay.portal:com.liferay.portal.impl Maven
  • Low 2.0
    CVE-2025-62255

    Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page

    Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versi…

    Liferay DXP Portal com.liferay:com.liferay.knowledge.base.web Maven
  • Medium 6.9
    CVE-2025-62256

    Liferay Portal and DXP do not properly restrict access to OpenAPI

    Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not properly restrict access to OpenAPI in certain circum…

    Liferay DXP Portal com.liferay:com.liferay.portal.security.auth.verifier Maven
  • Low 2.0
    CVE-2025-62247

    Liferay Portal and DXP are Missing Authorization in Collection Provider

    Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.…

    Liferay DXP Portal com.liferay:com.liferay.search.experiences.service Maven
  • Medium 4.8
    CVE-2025-62248

    Liferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS)

    A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1…

    Liferay DXP Portal com.liferay:com.liferay.dynamic.data.mapping.web Maven
  • Medium 6.9
    CVE-2025-62249

    Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3…

    Liferay DXP Portal com.liferay.portal:com.liferay.portal.impl Maven
  • Medium 6.9
    CVE-2025-62250

    Liferay Portal fails to verify messages from the cluster network is trusted

    Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attacke…

    Liferay DXP Portal com.liferay:com.liferay.portal.cluster.multiple Maven
  • Medium 4.8
    CVE-2025-62251

    Liferay has Incorrect Permission Assignment for Critical Resource

    Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows content to users who do not have permission to view it via the Menu Display Widget. Th…

    Liferay DXP Portal com.liferay:com.liferay.site.navigation.menu.item.asset.vocabulary Maven
  • Medium 5.3
    CVE-2025-62252

    Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key

    Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported version…

    Liferay DXP Portal com.liferay.portal:com.liferay.portal.impl Maven
  • Medium 4.8
    CVE-2025-62246

    Liferay Mentions Web is Vulnerable to Cross-site Scripting

    Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported ver…

    Liferay DXP Portal com.liferay:com.liferay.mentions.web Maven
  • Medium 5.3
    CVE-2025-62241

    Liferay Commerce Order Content Web is Vulnerable to Authorization Bypass Through User-Controlled Key

    Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to from one virtual instance to view the shipment addresses of different virtual instance via the _com_l…

    Liferay DXP com.liferay.commerce:com.liferay.commerce.order.content.web Maven
  • Medium 5.3
    CVE-2025-62242

    Liferay Account Admin Web vulnerable to Authorization Bypass Through User-Controlled Key

    Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users …

    Liferay DXP Portal com.liferay:com.liferay.change.tracking.web Maven
  • Medium 5.3
    CVE-2025-62243

    Liferay Publications is vulnerable to Incorrect Authorization

    Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to vi…

    Liferay DXP Portal com.liferay:com.liferay.change.tracking.web Maven
  • Medium 4.8
    CVE-2025-62244

    Liferay Publications vulnerable to Authorization Bypass Through User-Controlled Key

    Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and 7.3 GA through update 36 allows remote…

    Liferay DXP Portal com.liferay:com.liferay.change.tracking.web Maven
  • Medium 5.1
    CVE-2025-62245

    Liferay Portal is vulnerable to CSRF through publication comments

    Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.

    Liferay DXP Portal com.liferay:com.liferay.change.tracking.web Maven
  • Medium 4.8
    CVE-2025-62237

    Liferay Portal Commerce is vulnerable to XSS through account "name" field

    Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 8 through update 92 allows remote attackers to …

    Liferay DXP Portal com.liferay.commerce:com.liferay.commerce.order.web Maven
  • Medium 4.8
    CVE-2025-62238

    Liferay Portal's Membership page is vulnerable to XSS through “name“ text field

    Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remot…

    Liferay DXP Portal com.liferay:com.liferay.account.admin.web Maven
  • Medium 4.6
    CVE-2025-62239

    Liferay Portal is vulnerable to XSS through its workflow process builder

    Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attack…

    Liferay DXP Portal com.liferay:com.liferay.portal.workflow.kaleo.designer.web Maven
  • Medium 4.8
    CVE-2025-62240

    Liferay Portal is vulnerable to XSS through its Calendar Events parameters

    Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 update 35 through update 92, and 7.3 update 25 through update …

    Liferay DXP Portal com.liferay:com.liferay.calendar.web Maven
  • Medium 4.8
    CVE-2025-43771

    Liferay Portal Notifications Widget has multiple XSS vulnerabilities through various text fields

    Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.10 allow remote attackers to inject arbitrary web script o…

    Liferay DXP Portal com.liferay:com.liferay.flags.web Maven
  • Medium 4.8
    CVE-2025-43829

    Liferay Portal Commerce Shop is vulnerable to Stored XSS through SVG file

    Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.18 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 18 through update 92 allows remote atta…

    Liferay DXP Portal com.liferay.commerce:com.liferay.commerce.shop.by.diagram.web Maven
  • Medium 5.1
    CVE-2025-43830

    Liferay Portal is vulnerable to Stored XSS through Forms text type field

    Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35 allows remote attackers to inj…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 4.8
    CVE-2025-43821

    Liferay Portal is vulnerable to XSS through its Commerce Product's Name text field

    Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote attackers …

    Liferay DXP Portal com.liferay.commerce:com.liferay.commerce.product.service Maven
  • Medium 4.8
    CVE-2025-43822

    Liferay Portal has multiple Stored XSS vulnerabilities on its View Order page

    Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92 allow remote attackers to inject arbitrary w…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 4.8
    CVE-2025-43823

    Liferay Portal is vulnerable to XSS through its Commerce Search Result widget

    Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92 allows remote attackers to inject arbitrary w…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 4.8
    CVE-2025-43824

    Liferay Profile Widget does not prevent vCard extension spoofing

    The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven