https://vulnogram.org/ Most recent CVEs assigned by Liferay, Inc. (liferay). https://vulnogram.org/seaview/icons/liferay.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2025-62275 https://vulnogram.org/CVE-2025-62275 Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images… Medium Network Exploitable Sat, 01 Nov 2025 02:42:50 GMT https://vulnogram.org/CVE-2025-62276 https://vulnogram.org/CVE-2025-62276 The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported… Medium Fri, 31 Oct 2025 23:34:20 GMT https://vulnogram.org/CVE-2025-62267 https://vulnogram.org/CVE-2025-62267 Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 35 through update… Medium Fri, 31 Oct 2025 18:12:50 GMT https://vulnogram.org/CVE-2025-62264 https://vulnogram.org/CVE-2025-62264 Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92 allows remote attacke… Medium Network Exploitable Fri, 31 Oct 2025 17:32:01 GMT https://vulnogram.org/CVE-2025-62265 https://vulnogram.org/CVE-2025-62265 Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA throug… Medium Thu, 30 Oct 2025 18:30:35 GMT https://vulnogram.org/CVE-2025-62266 https://vulnogram.org/CVE-2025-62266 By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is v… Medium Network Exploitable Thu, 30 Oct 2025 17:37:21 GMT https://vulnogram.org/CVE-2025-62257 https://vulnogram.org/CVE-2025-62257 Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older… Medium Network Exploitable Wed, 29 Oct 2025 23:24:42 GMT https://vulnogram.org/CVE-2025-62258 https://vulnogram.org/CVE-2025-62258 CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headl… High Network Exploitable Mon, 27 Oct 2025 22:56:21 GMT https://vulnogram.org/CVE-2025-62259 https://vulnogram.org/CVE-2025-62259 Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has ve… Medium Network Exploitable Mon, 27 Oct 2025 22:13:35 GMT https://vulnogram.org/CVE-2025-62260 https://vulnogram.org/CVE-2025-62260 Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which all… High Mon, 27 Oct 2025 21:44:08 GMT https://vulnogram.org/CVE-2025-62261 https://vulnogram.org/CVE-2025-62261 Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which a… Medium Mon, 27 Oct 2025 21:11:46 GMT https://vulnogram.org/CVE-2025-62262 https://vulnogram.org/CVE-2025-62262 Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and… Medium Mon, 27 Oct 2025 20:39:23 GMT https://vulnogram.org/CVE-2025-62263 https://vulnogram.org/CVE-2025-62263 Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 service pack 3 through update 36 allow remote attackers to inject arbitrary web… Medium Mon, 27 Oct 2025 19:38:44 GMT https://vulnogram.org/CVE-2025-62253 https://vulnogram.org/CVE-2025-62253 Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsuppo… Medium Network Exploitable Mon, 27 Oct 2025 18:54:47 GMT https://vulnogram.org/CVE-2025-62254 https://vulnogram.org/CVE-2025-62254 The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions d… Medium Network Exploitable Thu, 23 Oct 2025 22:16:34 GMT https://vulnogram.org/CVE-2025-62255 https://vulnogram.org/CVE-2025-62255 Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsuppor… Low Thu, 23 Oct 2025 18:47:18 GMT https://vulnogram.org/CVE-2025-62256 https://vulnogram.org/CVE-2025-62256 Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not properly restrict access to OpenAPI in certa… Medium Network Exploitable Thu, 23 Oct 2025 13:41:42 GMT https://vulnogram.org/CVE-2025-62247 https://vulnogram.org/CVE-2025-62247 Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 thro… Low Wed, 22 Oct 2025 19:27:25 GMT https://vulnogram.org/CVE-2025-62248 https://vulnogram.org/CVE-2025-62248 A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7,… Medium Wed, 22 Oct 2025 19:07:55 GMT https://vulnogram.org/CVE-2025-62249 https://vulnogram.org/CVE-2025-62249 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 throug… Medium Network Exploitable Tue, 21 Oct 2025 18:12:45 GMT https://vulnogram.org/CVE-2025-62250 https://vulnogram.org/CVE-2025-62250 Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remot… Medium Network Exploitable Tue, 21 Oct 2025 15:40:52 GMT https://vulnogram.org/CVE-2025-62251 https://vulnogram.org/CVE-2025-62251 Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows content to users who do not have permission to view it via the Menu Display W… Medium Mon, 13 Oct 2025 21:23:34 GMT https://vulnogram.org/CVE-2025-62252 https://vulnogram.org/CVE-2025-62252 Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupporte… Medium Mon, 13 Oct 2025 20:42:23 GMT https://vulnogram.org/CVE-2025-62246 https://vulnogram.org/CVE-2025-62246 Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupp… Medium Mon, 13 Oct 2025 20:21:28 GMT https://vulnogram.org/CVE-2025-62241 https://vulnogram.org/CVE-2025-62241 Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to from one virtual instance to view the shipment addresses of different virtual instance via t… Medium Mon, 13 Oct 2025 19:32:15 GMT https://vulnogram.org/CVE-2025-62242 https://vulnogram.org/CVE-2025-62242 Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticat… Medium Mon, 13 Oct 2025 19:10:30 GMT https://vulnogram.org/CVE-2025-62243 https://vulnogram.org/CVE-2025-62243 Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attack… Medium Mon, 13 Oct 2025 17:14:58 GMT https://vulnogram.org/CVE-2025-62244 https://vulnogram.org/CVE-2025-62244 Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and 7.3 GA through update 36 allo… Medium Mon, 13 Oct 2025 16:53:35 GMT https://vulnogram.org/CVE-2025-62245 https://vulnogram.org/CVE-2025-62245 Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication com… Medium Network Exploitable Fri, 10 Oct 2025 19:12:11 GMT https://vulnogram.org/CVE-2025-62237 https://vulnogram.org/CVE-2025-62237 Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 8 through update 92 allows remote atta… Medium Fri, 10 Oct 2025 12:51:14 GMT https://vulnogram.org/CVE-2025-62238 https://vulnogram.org/CVE-2025-62238 Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 all… Medium Fri, 10 Oct 2025 12:33:36 GMT https://vulnogram.org/CVE-2025-62239 https://vulnogram.org/CVE-2025-62239 Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticat… Medium Fri, 10 Oct 2025 12:21:53 GMT https://vulnogram.org/CVE-2025-62240 https://vulnogram.org/CVE-2025-62240 Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 update 35 through update 92, and 7.3 update 25 throug… Medium Thu, 09 Oct 2025 21:08:50 GMT https://vulnogram.org/CVE-2025-43771 https://vulnogram.org/CVE-2025-43771 Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.10 allow remote attackers to inject arbitrary web… Medium Wed, 08 Oct 2025 14:13:40 GMT https://vulnogram.org/CVE-2025-43829 https://vulnogram.org/CVE-2025-43829 Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.18 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 18 through update 92 allows re… Medium Wed, 08 Oct 2025 13:55:53 GMT https://vulnogram.org/CVE-2025-43830 https://vulnogram.org/CVE-2025-43830 Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35 allows remote attacke… Medium Network Exploitable Wed, 08 Oct 2025 13:11:37 GMT https://vulnogram.org/CVE-2025-43821 https://vulnogram.org/CVE-2025-43821 Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote a… Medium Wed, 08 Oct 2025 12:53:20 GMT https://vulnogram.org/CVE-2025-43822 https://vulnogram.org/CVE-2025-43822 Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92 allow remote attackers to inject ar… Medium Tue, 07 Oct 2025 22:16:03 GMT https://vulnogram.org/CVE-2025-43823 https://vulnogram.org/CVE-2025-43823 Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92 allows remote attackers to inject ar… Medium Tue, 07 Oct 2025 21:54:54 GMT https://vulnogram.org/CVE-2025-43824 https://vulnogram.org/CVE-2025-43824 The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the… Medium Mon, 06 Oct 2025 22:05:53 GMT https://vulnogram.org/CVE-2025-43825 https://vulnogram.org/CVE-2025-43825 A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.1… Medium Fri, 03 Oct 2025 21:16:28 GMT https://vulnogram.org/CVE-2025-43826 https://vulnogram.org/CVE-2025-43826 Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 9… Medium Tue, 30 Sep 2025 22:36:31 GMT https://vulnogram.org/CVE-2025-43827 https://vulnogram.org/CVE-2025-43827 Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10… Medium Tue, 30 Sep 2025 18:57:54 GMT https://vulnogram.org/CVE-2025-43817 https://vulnogram.org/CVE-2025-43817 Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92 allow remote attackers to inject… Medium Mon, 29 Sep 2025 22:30:25 GMT https://vulnogram.org/CVE-2025-43813 https://vulnogram.org/CVE-2025-43813 Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update… Medium Network Exploitable Mon, 29 Sep 2025 22:19:02 GMT https://vulnogram.org/CVE-2025-43812 https://vulnogram.org/CVE-2025-43812 Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to… Medium Mon, 29 Sep 2025 22:09:29 GMT https://vulnogram.org/CVE-2025-43811 https://vulnogram.org/CVE-2025-43811 Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.7, and 7.4 update 50 through update 92 allows… Medium Mon, 29 Sep 2025 21:59:51 GMT https://vulnogram.org/CVE-2025-43820 https://vulnogram.org/CVE-2025-43820 Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through up… Medium Mon, 29 Sep 2025 21:48:52 GMT https://vulnogram.org/CVE-2025-43818 https://vulnogram.org/CVE-2025-43818 Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update… Medium Mon, 29 Sep 2025 21:38:59 GMT https://vulnogram.org/CVE-2025-43815 https://vulnogram.org/CVE-2025-43815 Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, and 2023.Q3.5 allows remote attackers to inject arbitrary web script or HTML… Medium Network Exploitable Mon, 29 Sep 2025 21:19:11 GMT