Zum Hauptinhalt springen

Planned maintenance is scheduled for the week of June 15th - the exact date and time will be announced soon. See More Details

Blogs
Contribute
Meet
Security
Discuss
Download
Learn
Log In

Hall of Fame

Security Overview
Reporting Security Issues
Known Vulnerabilities
Hall of Fame

1

n1shym4

BFLA/BOLA: updateShellAccess & updateSupportAccess GraphQL mutations allow any authenticated user to toggle access flags on any project

1

Noorsyaf Zati Il Aqmar

XSS vulnerability in Content Dashboard De

1

Wesley Thijs (The Amazing Rat)

Improper Access Control vulnerability in Publications

1

Joy Ahmed (joy401125)

Improper Access Control vulnerability in Utility Pages

5

Sourav Paul

Reflected XSS through the displayType parameter
XSS vulnerability in Language Override
XSS vulnerability in SearchContainerColumnTextTag
XSS vulnerability in List view of Organizations
XSS vulnerability in UserCardTag

1

Stored XSS with radio button type custom fields

1

Nitesh Singh (singhnitesh21)

Open Bug Bounty - liferay.com Security Vulnerability Notification | Confidential & Important 2025-09-20

1

Mariani Francesco

LPS-127823

2

Lauritz Holme

Stored XSS on the name of a fieldset
Stored XSS via organization site names

1

Shailesh Suthar

XSS Vulnerability - google_widget

3

Shubham Shah

Reflected XSS in blogs-web
Reflected XSS in maketplace-app-manager-web
Blind SSRF in portal-settings-authentication-opensso-web/.../test_opensso.jsp

1

Francesco Dalena

Liferay allows more than 300kb profile picture into the user profile

1

Simone Capparelli

Liferay allows more than 300kb profile picture into the user profile

1

Lorenzo Toti

Liferay allows more than 300kb profile picture into the user profile

3

Adam Kues

Reflected XSS in blogs-web
Reflected XSS in maketplace-app-manager-web
Blind SSRF in portal-settings-authentication-opensso-web/.../test_opensso.jsp

1

Mahesh Agaji Pandhare

Missing Security Headers on liferay.com

1

TF1T

DOM based XSS at /o/layout-taglib/__liferay__/index.js (CVE-2025-2536)

1

Dtro

DOM based XSS at /o/layout-taglib/__liferay__/index.js (CVE-2025-2536)

2

Cross-Site Scripting (XSS) Vulnerability in Fragment Preview Functionality
CAPTCHA Bypass for Gogo Shell

1

Leaked nexus credentials in a public GitHub repository

1

Internal site XSS via insecure sub-resource

1

Wiki page privilege escalation (CVE-2022-45320)

1

Barnabás Horváth (T4r0)

User enumeration vulnerability by comparing login response time (CVE-2024-26268)

1

Vulnerability in CKEditor 1.16.2

1

Stored XSS with instanceId in DDMForm

1

Duracell80

Password reminder answers are not obfuscated

1

SFP issue on clayui.com

4

NDIx

XSS with backURL in Layout SEO (CVE-2023-3193)
Open redirect vulnerability with backURL in Layout SEO (CVE-2023-35029)
CSRF vulnerability with backURL in Layout SEO (CVE-2023-35030)
XSS with `p_l_back_url_title` on edit content page (CVE-2023-47797)

1

Combo servlet path traversal

1

XSS with Document and Media document title

7

Open redirect in Countries Management (CVE-2023-5190)
XSS with with Account "Blocked Email Domains" (CVE-2023-40191)
XSS with `tabs2` in role assignment (CVE-2023-42496)
XSS with `redirect` in export translation (CVE-2023-42497)
XSS with `key` in language override (CVE-2023-42498)
XSS with `externalReferenceCode` in Objects (CVE-2023-42630)
Open redirect in adaptive media (CVE-2023-44308)

6

Open redirect in page administration (CVE-2023-44307)
Open redirect in System/Instance/Site Settings (CVE-2023-5083)
XSS with "Service Class" in Service Access Policy (CVE-2023-37940)
XSS with Result Ranking's search query (CVE-2023-40192)
XSS with URL path in item selector (CVE-2023-42499)
XSS with `searchContainerId` in Asset Libraries import (CVE-2023-42500)

3

Multiple Stored XSS with shipping & billing address (CVE-2023-42627)
XSS with child wiki pages (CVE-2023-42628)
Stored XSS vulnerability with vocabulary description (CVE-2023-42629)

1

Stealer malware database

3

4rth4s

Unauthorized access to "Content Page" previews (CVE-2022-39975)
Friendly URL history accessible to unauthorized users (CVE-2022-42127)
Unauthorized view access to Organization names (CVE-2023-3426)

1

Database password leaked on GitHub

1

Password Disclosure

1

Independent Security Researcher

Example servlet on https://cloud-10-0-20-48.liferay.com

1

NTF SADNAN

Path traversal found on cdn.alloyui.com

1

Incorrectly configured visiblity on Jira ticket

2

A1 Digital International

CVE-2022-38901 Stored XSS with categories selector fields
CVE-2022-38902 Stored XSS with SVG file description

1

Nikhil Rane

Website Issue

4

aoxsin

Server version disclosure
Server version disclosure
Server version disclosure
Server version disclosure

1

Kanta Nishitani

of Ierae Security

LPS-134833

2

Sanket Anil Ambalkar

DNS CAA
No DMARC record on liferay.dev

4

Duy Huynh

Reflected XSS with `keywords` in Search (CVE-2021-35463)
XSS vulnerability with form field help text (CVE-2022-26594)
Stored XSS with ERC in Commerce catalog (CVE-2022-42119)
Stored XSS with object name in App Builder (CVE-2023-33938)

1

Hasibul Hasan Rifat

Website Issue

1

notsag-dev

Dependency Confusion

Zeige 1 bis 48 von 126 Einträgen.

1
2
3

3

4rth4s

Unauthorized access to "Content Page" previews (CVE-2022-39975)
Friendly URL history accessible to unauthorized users (CVE-2022-42127)
Unauthorized view access to Organization names (CVE-2023-3426)

6

Open redirect in page administration (CVE-2023-44307)
Open redirect in System/Instance/Site Settings (CVE-2023-5083)
XSS with "Service Class" in Service Access Policy (CVE-2023-37940)
XSS with Result Ranking's search query (CVE-2023-40192)
XSS with URL path in item selector (CVE-2023-42499)
XSS with `searchContainerId` in Asset Libraries import (CVE-2023-42500)

1

Abison Binoy

Website Issue

3

Adam Kues

Reflected XSS in blogs-web
Reflected XSS in maketplace-app-manager-web
Blind SSRF in portal-settings-authentication-opensso-web/.../test_opensso.jsp

1

Incorrectly configured visiblity on Jira ticket

1

Aditya Sharma

Independent security researcher

Website Issue

1

Ai Ho (j3ssie)

Website issue

1

Akash Rajendra Patil

Website Issue

1

Ali BawazeEer

Penetration tester

Website Issue

1

Ali Raza

Website Issue

1

Alvaro Muñoz (@pwntester)

CST-7302

7

Open redirect in Countries Management (CVE-2023-5190)
XSS with with Account "Blocked Email Domains" (CVE-2023-40191)
XSS with `tabs2` in role assignment (CVE-2023-42496)
XSS with `redirect` in export translation (CVE-2023-42497)
XSS with `key` in language override (CVE-2023-42498)
XSS with `externalReferenceCode` in Objects (CVE-2023-42630)
Open redirect in adaptive media (CVE-2023-44308)

1

Andrey Plastunov

Security Researcher - Digital Security Company (dsec.ru)

LPS-54694

1

Anurag Kumar

Bug Hunter

Website Issue

4

aoxsin

Server version disclosure
Server version disclosure
Server version disclosure
Server version disclosure

1

Ariel Garcia

IT Security Consultant

LPS-51094

3

Arun Das

Lodash Prototype Pollution (CVE-2019-10744)
Security vulnerability in jQuery 3.4.1 (CVE-2020-11022)
Vulnerable Tomcat version in Portal 7.3.5

1

Wiki page privilege escalation (CVE-2022-45320)

1

Barnabás Horváth (T4r0)

User enumeration vulnerability by comparing login response time (CVE-2024-26268)

1

Bob Brinks

LPS-48667

1

Bryan Alexander

LPS-51664

1

Chaitanya vig

LPS-112726

1

Chiheb Chebbi

Stack traces visible on www-ci.liferay.com

1

Christian Mehlmauer

CST-7060

1

Christian Schneider

Software Developer, Whitehat Hacker & Trainer

LPS-54386

1

Craig Young

Principal Security Researcher

CST-7017

1

Daniel Jensen

LPS-54695

1

Dennis Van Elst

Threat and Vulnerability Management Security Consultant, DXC Security Advisory Services

DOM based XSS through CKEditor destroy

1

Dhaval Ramani

Website Issue

1

Do Huan (vnhacker1337)

[Security Report] Liferay CVE-2020-7961 Lead to RCE in https://lcs.liferay.com

1

Dtro

DOM based XSS at /o/layout-taglib/__liferay__/index.js (CVE-2025-2536)

4

Duy Huynh

Reflected XSS with `keywords` in Search (CVE-2021-35463)
XSS vulnerability with form field help text (CVE-2022-26594)
Stored XSS with ERC in Commerce catalog (CVE-2022-42119)
Stored XSS with object name in App Builder (CVE-2023-33938)

1

Dzianis Skliar

IT Security Analyst

Not published issues

1

Eeshwar Dronavalli

Website issue

1

XSS with Document and Media document title

1

Faisal Mehmood

Website Issue

1

Faizal Mahida

Website Issue

1

Faizan Ahmed

Website issue: "Vulnerability Report (3) Weak implementation Of Tokens"

1

Francesco Dalena

Liferay allows more than 300kb profile picture into the user profile

1

Leaked nexus credentials in a public GitHub repository

2

Cross-Site Scripting (XSS) Vulnerability in Fragment Preview Functionality
CAPTCHA Bypass for Gogo Shell

3

Gergő Czuczor

Qualified Evaluator

CST-7046
CST-7053
CST-7103

1

Giuseppino Cadeddu

LPS-104213

1

Guilherme Scombatti

Website Issue

1

Hasibul Hasan Rifat

Website Issue

1

Vulnerability in CKEditor 1.16.2

Ein unerwarteter Fehler ist aufgetreten.

LPS-33471

1

İsmail Taşdelen

WhiteHat | Security Researcher

Website Issue

Zeige 1 bis 48 von 126 Einträgen.

1
2
3

1

Yadnyawalkya Tale

Security Researcher and Penetration Tester

Website Issue

1

Wesley Thijs (The Amazing Rat)

Improper Access Control vulnerability in Publications

1

SFP issue on clayui.com

1

Valerio Brussani

Penetration Tester & Security Researcher @ DXC Technology

CST-7130

1

Internal site XSS via insecure sub-resource

1

Database password leaked on GitHub

1

Tiago Sintra

CST-7102

1

TF1T

DOM based XSS at /o/layout-taglib/__liferay__/index.js (CVE-2025-2536)

4

Spyridon Chatzimichail

IT Security Engineer at Hellenic Telecommunications Organization S.A

LPS-66674
LPS-66675
CST-6233
CST-7024

5

Sourav Paul

Reflected XSS through the displayType parameter
XSS vulnerability in Language Override
XSS vulnerability in SearchContainerColumnTextTag
XSS vulnerability in List view of Organizations
XSS vulnerability in UserCardTag

1

Sourav Newatia

Cyber Security Analyst

Website Issue

1

Simone Capparelli

Liferay allows more than 300kb profile picture into the user profile

1

Simon Cecchini

From Verizon Enterprise Solutions

LPS-48071

1

Shwetabh Suman

Security Researcher

Website Issue

1

Independent Security Researcher

Example servlet on https://cloud-10-0-20-48.liferay.com

3

Shubham Shah

Reflected XSS in blogs-web
Reflected XSS in maketplace-app-manager-web
Blind SSRF in portal-settings-authentication-opensso-web/.../test_opensso.jsp

1

Shivam Kumar Agarwal

Website Issue

1

Shailesh Suthar

XSS Vulnerability - google_widget

1

Sergej Michel

Software Developer and Security Researcher

CST-7031

1

Combo servlet path traversal

1

Sarang Barshikar

Website issue

2

Sanket Anil Ambalkar

DNS CAA
No DMARC record on liferay.dev

1

Sandro Gauci

Penetration tester and vulnerability researcher

LPS-58014

1

Stored XSS with instanceId in DDMForm

1

Rui Silva

Website Issue

1

Rohit Soni

Cyber Security Analyst

Website Issue

1

Stealer malware database

1

Ramin Farajpour Cami

SaminRay Security

Website Issue

2

A1 Digital International

CVE-2022-38901 Stored XSS with categories selector fields
CVE-2022-38902 Stored XSS with SVG file description

1

Pranav Bhandari

Website Issue

1

Prajwal Khante

LPS-113348

1

Pradeep P Bhat

Website Issue

1

Password Disclosure

1

PEGASUS

Website Issue

1

Pedro Cardoso

Website Issue

1

Óscar de Pedro

LPS-54384

2

Osama Mahmood

Penetration tester and vulnerability researcher

LPS-61116
CST-7101

1

Olivier Spieser

LPS-25363

1

Olaf Fricke

LPS-54693

1

NTF SADNAN

Path traversal found on cdn.alloyui.com

1

notsag-dev

Dependency Confusion

1

Noorsyaf Zati Il Aqmar

XSS vulnerability in Content Dashboard De

1

Noah Wilcox

President at RHEV Studios

Website Issue

1

Nitesh Singh (singhnitesh21)

Open Bug Bounty - liferay.com Security Vulnerability Notification | Confidential & Important 2025-09-20

1

Nitesh Sharma

CST-7112

1

Nikhil Rane

Website Issue

4

NDIx

XSS with backURL in Layout SEO (CVE-2023-3193)
Open redirect vulnerability with backURL in Layout SEO (CVE-2023-35029)
CSRF vulnerability with backURL in Layout SEO (CVE-2023-35030)
XSS with `p_l_back_url_title` on edit content page (CVE-2023-47797)

1

n1shym4

BFLA/BOLA: updateShellAccess & updateSupportAccess GraphQL mutations allow any authenticated user to toggle access flags on any project

Zeige 1 bis 48 von 126 Einträgen.

1
2
3

Community

Company

Feedback

Blogs

Discuss

Meet

Open Source

Download

Events

Learn

Careers

Contact Us

Contribute

Copyright © 2026 Liferay, Inc

Powered by Liferay™

Diese Website verwendet Cookies

Wir verwenden Cookies, um personalisierte Inhalte bereitzustellen, Trends zu analysieren, die Website zu verwalten, Benutzerbewegungen auf der Website zu verfolgen und demografische Informationen über unsere Benutzerbasis insgesamt zu sammeln. Akzeptieren Sie alle Cookies, um die bestmögliche Erfahrung auf unserer Website zu machen, oder verwalten Sie Ihre Einstellungen. Besuchen Sie unsere Datenschutzrichtlinie