Skip to content

Vendor

com.liferay vulnerabilities

139 published CVES affecting com.liferay, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
139
Critical
2
High
10
Medium
121
Low
6
Unscored
0
CISA KEV
0
Atom feed of com.liferay alerts

Products

Latest com.liferay CVEs

Newest publication first · page 1 of 6

  2. CVE-2025-62276 Liferay Portal and DXP use an incorrect cache-control header

    Published
    MediumCVSS 4.6 EPSS 0.13%

    The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect ca...

  5. CVE-2025-62263 Liferay Portal Vulnerable to Cross-Site Scripting

    Published
    MediumCVSS 4.8 EPSS 0.22%

    Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 service pack 3 through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted p...

  8. CVE-2025-62256 Liferay Portal and DXP do not properly restrict access to OpenAPI

    Published
    MediumCVSS 6.9 EPSS 0.40%

    Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not properly restrict access to OpenAPI in certain circumstances, which allows...

  12. CVE-2025-62251 Liferay has Incorrect Permission Assignment for Critical Resource

    Published
    MediumCVSS 4.8 EPSS 0.27%

    Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows content to users who do not have permission to view it via the Menu Display Widget. This security flaw coul...

  13. CVE-2025-62246 Liferay Mentions Web is Vulnerable to Cross-site Scripting

    Published
    MediumCVSS 4.8 EPSS 0.22%

    Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions allow remote au...

  15. CVE-2025-62243 Liferay Publications is vulnerable to Incorrect Authorization

    Published
    MediumCVSS 5.3 EPSS 0.25%

    Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication commen...

  23. CVE-2025-43827 Liferay Portal Vulnerable to IDOR via audit events

    Published
    MediumCVSS 5.3 EPSS 0.31%

    Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, an...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.