Known Vulnerabilities

Liferay Portal 7.4.0 through 7.4.3.132 Liferay DXP 2025.Q2.0 through 2025.Q2.9 Liferay DXP 2025.Q1.0 through 2025.Q1.16 Liferay DXP 2024.Q4.0 through 2024.Q4.7 Liferay DXP 2024.Q3.1 through...

A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal and Liferay DXP allows a remote, authenticated attacker to inject and...

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows an remote non-authenticated attacker to inject JavaScript into the google_gadget. Liferay Portal...

A vulnerability in Liferay Portal and Liferay DXP allows sensitive user data to be included in the Freemarker template. This weakness permits an unauthorized actor to gain access to, and...

A Stored cross-site scripting vulnerability in the Liferay Portal and Liferay DXP allows an remote authenticated attacker to inject JavaScript through the organization site names. The malicious...

A Stored cross-site scripting vulnerability in the Liferay Portal and Liferay DXP allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious...

Liferay Portal and Liferay DXP exposes "Internal Server Error" in the response body when a login attempt is made with a deleted Client Secret. Liferay Portal 7.4.0 through 7.4.3.132 Liferay DXP...

A Stored cross-site scripting vulnerability in the Liferay Portal and Liferay DXP allows an remote authenticated attacker to inject JavaScript through the name of a fieldset in Kaleo Forms Admin....

Liferay Portal and Liferay DXP has a security vulnerability that allowing for improper access through the expandoTableLocalService. Liferay Portal 7.4.0 through 7.4.3.132 Liferay DXP 2025.Q2.0...

Liferay Portal and Liferay DXP allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled. Liferay Portal...

Liferay Portal fixed on master branch Liferay DXP 2025.Q2.6 Liferay DXP 2025.Q1.16 Liferay DXP 2024.Q1.21 This issue was reported by NDIx A stored DOM-based Cross-Site Scripting (XSS)...

Liferay Portal fixed on master branch Liferay DXP 2025.Q2.9 Liferay DXP 2025.Q1.16 Liferay DXP 2024.Q1.20 This issue was reported by NDIx A Stored cross-site scripting vulnerability in the Liferay...

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows a remote authenticated user to inject JavaScript code via...

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows a remote authenticated user to inject JavaScript code via...

A CSRF vulnerability in Liferay Portal and Liferay DXP allows remote attackers to performs cross-origin request on behalf of the authenticated user via the endpoint parameter. Liferay Portal 7.4.0...

Liferay Portal 7.4.0 through 7.4.3.132 Liferay DXP 2025.Q2.0 through 2025.Q2.2 Liferay DXP 2025.Q1.0 through 2025.Q1.14 Liferay DXP 2024.Q4.0 through 2024.Q4.7 Liferay DXP 2024.Q3.0 through...

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows a remote authenticated attacker to inject JavaScript code via...

Liferay Portal 7.4.3.132 Liferay DXP 2025.Q2.0 through 2025.Q2.2 Liferay DXP 2025.Q1.0 through 2025.Q1.15 Liferay DXP 2024.Q1.13 through 2024.Q1.19 Liferay Portal fixed on master branch Liferay DXP...

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect Liferay...

Liferay Portal 7.4.0 through 7.4.3.132 Liferay DXP 2025.Q1.0 through 2025.Q1.4 Liferay DXP 2024.Q4.0 through 2024.Q4.10 Liferay DXP 2024.Q3.1 through 2024.Q3.13 Liferay DXP 2024.Q2.0 through...

This issue was reported by NDIx A Stored cross-site scripting vulnerability in the Liferay Portal and Liferay DXP allows an remote authenticated attacker to inject JavaScript into the...

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the...

Liferay Portal fixed on master branch Liferay DXP 2025.Q2.0 This issue was reported by Gareth Catterall, AnchorSec security team The vulnerable code can bypass the Captcha check in Liferay Portal...

Liferay Portal and Liferay DXP is vulnerable to Insecure Direct Object Reference (IDOR) in the groupId parameter of the _com_liferay_roles_selector_web_portlet_RolesSelectorPortlet_groupId. When an...

A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal and Liferay DXP allows a user to upload more than 300kb profile picture into the user profile. This size more than the...

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows an remote authenticated user to inject JavaScript into the embedded message field from the form...

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows a remote authenticated attacker to inject JavaScript code via the content page's name field. This...

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows an remote authenticated user to inject JavaScript in message board threads and categories. Liferay...

Liferay Portal and Liferay DXP allow any authenticated user to modify the content of emails sent through the calendar portlet, allowing an attacker to send phishing emails to any other user in the...

SSRF vulnerability in FreeMarker templates in Liferay Portal and Liferay DXP allows template editors to bypass access validations via crafted URLs. Liferay Portal fixed on master branch Liferay DXP...

Liferay Portal and Liferay DXP allows unauthenticated users (guests) to access via URL files uploaded by object entry and stored in document_library Liferay Portal 7.4.0 through 7.4.3.132 Liferay...

Liferay Portal and Liferay DXP allows any authenticated remote user to view other calendars by allowing them to enumerate the names of other users, given an attacker the possibility to send...

Liferay Portal fixed on master branch Liferay DXP 2025.Q2.0 Liferay DXP 2025.Q1.5 Liferay DXP 2024.Q1.16 This issue was reported by Shubham Shah - CTO @ Assetnote and Adam Kues - Security...

Liferay Portal and Liferay DXP allows a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web due to improper validation of user-supplied URLs. An attacker...

Liferay Portal fixed on master branch Liferay DXP 2024.Q1.15 Liferay DXP 2025.Q1.4 Liferay DXP 2025.Q2.0 Liferay Portal 7.4.0 through 7.4.3.132 Liferay DXP 2025.Q1.0 through 2025.Q1.3 Liferay DXP...

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows an remote authenticated attacker to inject JavaScrip in the...

Liferay Portal fixed on master branch Liferay DXP 2024.Q1.14 Liferay DXP 2024.Q4.6 Liferay DXP 2025.Q1.0 This issue was reported by Gareth Catterall, AnchorSec security team The fragment preview...

Liferay Portal and Liferay DXP allows unauthenticated users (guests) to access via URL files uploaded in the form and stored in document_library Liferay Portal fixed on master branch Liferay DXP...

Liferay Portal and Liferay DXP allow users to upload an unlimited amount of files through the forms, the files are stored in the document_library allowing an attacker to cause a potential DDoS....

Liferay Portal and Liferay DXP allows remote unauthenticated users (guests) to upload files via the form attachment field without proper validation, enabling extension obfuscation and bypassing...