Liferay Dxp vulnerabilities
240 known vulnerabilities affecting liferay/dxp.
Total CVEs
240
CISA KEV
0
Public exploits
4
Exploited in wild
2
Severity breakdown
CRITICAL5HIGH30MEDIUM202LOW3
Vulnerabilities
Page 12 of 12
CVE-2025-43794P4MEDIUMCVSS 4.8≥ 7.3.10, ≤ 7.3.10-u35≥ 7.4.13, ≤ 7.4.13-u92+2 more2025-09-15
CVE-2025-43794 [MEDIUM] CWE-79 CVE-2025-43794: Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older
Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote authenticated attackers with the instance administrator role to inject arbit
nvd
CVE-2021-29052P4MEDIUMCVSS 4.3v7.32021-05-17
CVE-2021-29052 [MEDIUM] CWE-276 CVE-2021-29052: The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1
The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls.
nvd
CVE-2023-33947P4MEDIUMCVSS 4.3≥ 7.4.13, ≤ 7.4.13.u602023-05-24
CVE-2023-33947 [MEDIUM] CWE-284 CVE-2023-33947: The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 d
The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching for the object definition.
nvd
CVE-2025-43739P4MEDIUMCVSS 4.3≥ 7.4.13, ≤ 7.4.13-u92≥ 2024.Q1.1, ≤ 2024.Q1.19+4 more2025-08-19
CVE-2025-43739 [MEDIUM] CWE-203 CVE-2025-43739: Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 throu
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allow any authenticated user to modify the content of emails sent through the calendar portlet, allowing an attacker to
nvd
CVE-2025-62244P4MEDIUMCVSS 4.3≥ 7.3.10, ≤ 7.3.10-u36≥ 7.4.13, ≤ 7.4.13-u92+2 more2025-10-13
CVE-2025-62244 [MEDIUM] CWE-639 CVE-2025-62244: Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 throug
Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and 7.3 GA through update 36 allows remote authenticated attackers to view the edit page of a publication via the _com_liferay_change_
nvd
CVE-2025-43810P4MEDIUMCVSS 4.3≥ 7.4.13, ≤ 7.4.13-u92≥ 2023.Q3.1, ≤ 2023.Q3.10+1 more2025-09-22
CVE-2025-43810 [MEDIUM] CWE-639 CVE-2025-43810: Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.
Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to add a note to an order in a different virtual instance via
nvd
CVE-2023-33946P4MEDIUMCVSS 4.3≥ 7.4.13, ≤ 7.4.13.u482023-05-24
CVE-2023-33946 [MEDIUM] CWE-284 CVE-2023-33946: The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 d
The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page.
nvd
CVE-2023-3426P4MEDIUMCVSS 4.3≥ 7.4.13.u81, ≤ 7.4.13.u852023-08-02
CVE-2023-3426 [MEDIUM] CWE-425 CVE-2023-3426: The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81
The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.
nvd
CVE-2025-43736P4MEDIUMCVSS 4.3≥ 7.4.13, ≤ 7.4.13-u92≥ 2024.Q1.1, ≤ 2024.Q1.16+4 more2025-08-12
CVE-2025-43736 [MEDIUM] CWE-770 CVE-2025-43736: A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.
A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload more than 300kb profile pictur
nvd
CVE-2025-43788P4MEDIUMCVSS 4.3≥ 7.4.13-u81, ≤ 7.4.13-u85≥ 2024.Q1.1, ≤ 2024.Q1.122025-09-12
CVE-2025-43788 [MEDIUM] CWE-862 CVE-2025-43788: The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 throu
The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.
nvd
CVE-2023-37940P4MEDIUMCVSS 4.8≥ 7.0.10, ≤ de-102≥ 7.1.10, ≤ dxp-28+3 more2024-12-17
CVE-2023-37940 [MEDIUM] CWE-79 CVE-2023-37940: Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.
Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's `Servi
nvd
CVE-2024-25150P4MEDIUMCVSS 4.3≥ 7.3.10, ≤ 7.3.10-dxp-3≥ 7.2.10, ≤ 7.2.10-dxp-182024-02-20
CVE-2024-25150 [MEDIUM] CWE-201 CVE-2024-25150: Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
nvd
CVE-2022-39975P4MEDIUMCVSS 4.3v7.3v7.3-update_1+42 more2022-09-22
CVE-2022-39975 [MEDIUM] CWE-862 CVE-2022-39975: The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10,
The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation.
nvd
CVE-2025-62262P4MEDIUMCVSS 4.4≥ 7.3.10, ≤ 7.3.10-u35≥ 7.4.13, ≤ 7.4.13-u92+1 more2025-10-27
CVE-2025-62262 [MEDIUM] CWE-532 CVE-2025-62262: Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 t
Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows local users to view user email address in the log files.
nvd
CVE-2025-2565P4MEDIUMCVSS 4.3≥ 7.4.13, ≤ 7.4.13-u92≥ 2023.Q3.1, ≤ 2023.Q3.10+4 more2025-03-20
CVE-2025-2565 [MEDIUM] CWE-201 CVE-2025-2565: The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0
The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 allows an unauthorized user to obtain entry data from forms.
nvd
CVE-2025-43809P4MEDIUMCVSS 4.3≥ 7.4.13, ≤ 7.4.13-u92≥ 2023.Q3.1, ≤ 2023.Q3.9+1 more2025-09-19
CVE-2025-43809 [MEDIUM] CWE-352 CVE-2025-43809: Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay
Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, and older unsupported versions allows remote attackers to register a server license vi
nvd
CVE-2025-62245P4MEDIUMCVSS 4.3≥ 7.4.13, ≤ 7.4.13-u92≥ 2023.Q3.1, ≤ 2023.Q3.10+1 more2025-10-10
CVE-2025-62245 [MEDIUM] CWE-352 CVE-2025-62245: Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Lifer
Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.
nvd
CVE-2025-3639P4LOWCVSS 2.0≥ 7.3.10, ≤ 7.3.10-u36≥ 7.4.13, ≤ 7.4.13-u92+5 more2025-08-18
CVE-2025-3639 [LOW] CWE-288 CVE-2025-3639: Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through
Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST
nvd
CVE-2025-43759P4LOWCVSS 2.7≥ 7.4.13, ≤ 7.4.13-u92≥ 2024.Q1.1, ≤ 2024.Q1.14+4 more2025-08-22
CVE-2025-43759 [LOW] CWE-732 CVE-2025-43759: Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows admin users of a virtual instance to add pages that are not in the default/main virtual instance, then any tenant can create a list o
nvd
CVE-2025-43732P4LOWCVSS 2.7≥ 7.4.13, ≤ 7.4.13-u92≥ 2024.Q1.1, ≤ 2024.Q1.17+4 more2025-08-18
CVE-2025-43732 [LOW] CWE-639 CVE-2025-43732: Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 thro
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 is vulnerable to Insecure Direct Object Reference (IDOR) in the groupId parameter of the _com_liferay_roles_selector_web_
nvd
← Previous12 / 12