Liferay Digital Experience Platform vulnerabilities
264 known vulnerabilities affecting liferay/digital_experience_platform.
Total CVEs
264
CISA KEV
0
Public exploits
4
Exploited in wild
2
Severity breakdown
CRITICAL3HIGH35MEDIUM224LOW2
Vulnerabilities
Page 14 of 14
CVE-2021-33339P4MEDIUMCVSS 4.8v7.22021-08-04
CVE-2021-33339 [MEDIUM] CWE-79 CVE-2021-33339: Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.
Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_admin_web_portlet_SiteAdminPortlet_name parameter.
nvd
CVE-2025-62245P4MEDIUMCVSS 4.3≥ 2023.Q3.1, ≤ 2023.Q3.10≥ 2023.q4.0, < 2023.q4.6+1 more2025-10-10
CVE-2025-62245 [MEDIUM] CWE-352 CVE-2025-62245: Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Lifer
Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.
nvd
CVE-2025-43759P4LOWCVSS 2.7≥ 2024.Q1.1, < 2024.Q1.15≥ 2024.q2.0, ≤ 2024.q2.13+4 more2025-08-22
CVE-2025-43759 [LOW] CWE-732 CVE-2025-43759: Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows admin users of a virtual instance to add pages that are not in the default/main virtual instance, then any tenant can create a list o
nvd
CVE-2025-43732P4LOWCVSS 2.7≥ 2024.Q1.1, < 2024.Q1.18≥ 2024.Q2.1, ≤ 2024.Q2.13+4 more2025-08-18
CVE-2025-43732 [LOW] CWE-639 CVE-2025-43732: Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 thro
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 is vulnerable to Insecure Direct Object Reference (IDOR) in the groupId parameter of the _com_liferay_roles_selector_web_
nvd
← Previous14 / 14