Known Vulnerabilities

Liferay Portal 7.4.3.112 Liferay Portal 7.4.3.112 Liferay DXP 2024.Q1.1 Liferay DXP 2024.Q1.1 Blogs in Liferay Portal and Liferay DXP does not check permission of images in a blog entry, which...

The Document Library and the Adaptive Media modules in Liferay Portal and Liferay DXP uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the...

Liferay Portal 7.4.3.35 through 7.4.3.111 Liferay DXP 2023.Q4.0 through 2023.Q4.10 Liferay DXP 2023.Q3.1 through 2023.Q3.10 Liferay DXP 7.4 U35 through U92 Liferay Portal 7.4.3.112 Liferay Portal...

Liferay DXP 2024.Q1.1 This issue was reported by argon21 Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal and Liferay DXP allows remote attackers to...

By default, Liferay Portal and Liferay DXP is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated by...

Password enumeration vulnerability in Liferay Portal and Liferay DXP allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack. Liferay...

CSRF vulnerability in Headless API in Liferay Portal and Liferay DXP allows remote attackers to execute any Headless API via the `endpoint` parameter. Liferay Portal 7.4.0 through 7.4.3.107 Liferay...

Liferay Portal and Liferay DXP does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application...

Liferay Portal and Liferay DXP stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s...

Liferay Portal 7.0.0 through 7.4.3.97 Liferay DXP 2023.Q3.1 through 2023.Q3.4 Liferay DXP 7.4 Liferay DXP 7.3 GA through U35 And older unsupported versions Liferay Portal 7.4.3.98 Liferay Portal...

Liferay Portal 7.4.3.104 Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q4.0 Liferay DXP 2023.Q3.5 Liferay Portal 7.3.7 through 7.4.3.92 Liferay DXP 2023.Q3.1 through 2023.Q3.4 Liferay DXP 7.4 Liferay DXP...

Liferay DXP 2024.Q1.1 Liferay Portal 7.4.3.112 Liferay DXP 2023.Q3.6 Liferay DXP 2023.Q4.3 Liferay DXP 7.3 U36 The ComboServlet in Liferay Portal and Liferay DXP does not limit the number or size...

Liferay DXP 7.3 U35 Liferay DXP 2023.Q3.6 Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal and Liferay DXP allows remote attackers to inject...

Liferay DXP 7.3 U36 Liferay Portal and Liferay DXP does not properly restrict access to OpenAPI in certain circumstances, which allows remote attackers to access the OpenAPI YAML file via a crafted...

Missing Authorization in Collection Provider component in the Liferay Portal and Liferay DXP allows instance users to read and select unauthorized Blueprints through the Collection Providers across...

A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal and Liferay DXP allows a remote, authenticated attacker to inject and...

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows an remote non-authenticated attacker to inject JavaScript into the google_gadget. Liferay Portal...

Liferay Portal 7.0.0 through 7.4.3.132 Liferay DXP 2023.Q4.0 through 2023.Q4.1 Liferay DXP 2023.Q3.1 through 2023.Q3.4 Liferay DXP 7.4 GA through update 92 Liferay DXP 7.3 GA through update 35, and...

Liferay Portal 7.4.3.120 Liferay Portal 7.4.3.120 Liferay DXP 2024.Q2.0 Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q4.6 Liferay DXP 2023.Q3.9 Liferay DXP 2024.Q1.1 Liferay DXP 2024.Q2.0 Liferay DXP...

Liferay DXP 2024.Q4.6 Liferay DXP 2024.Q1.13 Liferay DXP 2025.Q2.0 Liferay DXP 2025.Q1.5 A vulnerability in Liferay Portal and Liferay DXP allows sensitive user data to be included in the...

A memory leak in the headless API for StructuredContents in Liferay Portal and Liferay DXP allows an attacker to cause server unavailability (denial of service) via repeatedly calling the API...

Liferay Portal 7.4.3.132 Liferay DXP 2025.Q1.0 Liferay DXP 2024.Q1.13 Liferay DXP 2024.Q4.4 Liferay Portal 7.4.3.121 through 7.3.3.131 Liferay DXP 2024.Q1.1 through 2024.Q1.12 Liferay DXP 2024.Q2.0...

Liferay Portal 7.4.3.113 Liferay DXP 2024.Q2.0 Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q4.9 Liferay Portal 7.2.0 through 7.4.3.112 Liferay DXP 2023.Q4.0 through 2023.Q4.8 Liferay DXP 2023.Q3.1...

Liferay DXP 2024.Q2.0 Liferay Portal 7.4.3.113 Liferay DXP 2023.Q4.8 Liferay DXP 2024.Q1.1 Batch Engine in Liferay Portal and Liferay DXP does not properly check permission with import and export...

Liferay DXP 2023.Q3.9 Liferay DXP 2023.Q4.8 Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal and Liferay DXP allows remote attackers to...

Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via the...

Liferay Portal and Liferay DXP does not perform an authorization check when users attempt to view a display page template, which allows remote attackers to view display page templates via crafted...

Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal and Liferay DXP allows remote attackers to perform a denial-of-service (DoS) attacks via a crafted XML-RPC request....

In Liferay Portal and Liferay DXP, the default membership type of a newly created site is “Open” which allows any registered users to become a member of the site. A remote attacker with site...

Liferay DXP allows a time-based one-time password (TOTP) to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user....

Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q3.5 Liferay DXP 2023.Q4.1 Liferay Portal 7.4.3.112 Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal and Liferay DXP allows remote...

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal and Liferay DXP allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a "Rich Text"...

Remote staging in Liferay DXP does not properly obtain the remote address of the live site from the database which, which allows remote authenticated users to exfiltrate data to an attacker...

Liferay Portal and Liferay DXP may incorrectly identify the subdomain of a domain name and create a supercookie, which allows remote attackers who control a website that share the same TLD to read...

Liferay DXP 2023.Q4.1 Liferay DXP 2024.Q1.1 Liferay DXP 7.3 U36 Liferay DXP 2023.Q3.5 Stored cross-site scripting (XSS) vulnerability in Liferay Portal and Liferay DXP allows remote authenticated...

Liferay DXP 7.3 U36 Liferay DXP 2023.Q3.5 Liferay Portal and Liferay DXP does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform...

A Stored cross-site scripting vulnerability in the Liferay Portal and Liferay DXP allows an remote authenticated attacker to inject JavaScript through the organization site names. The malicious...

Reflected cross-site scripting (XSS) vulnerability in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via the /c/portal/comment/discussion/get_editor...

Improper Access Control vulnerability in Liferay Portal and Liferay DXP allows guest users to obtain object entries information via the API Builder. Liferay Portal 7.4.3.125 Liferay DXP 2024.Q1.13...

Liferay Portal 7.4.3.45 through 7.4.3.125 Liferay DXP 7.4 U45 through U92 Liferay DXP 2024.Q1.1 through 2024.Q1.12 Liferay DXP 2024.Q2.0 through 2024.Q2.9 Liferay Portal 7.4.3.129 Liferay Portal...

Liferay Portal 7.4.0 through 7.4.3.132 Liferay DXP 7.4 GA through U92 Liferay DXP 2024.Q1.1 through DXP 2024.Q1.19 Liferay DXP 2024.Q2.0 through DXP 2024.Q2.13 Liferay DXP 2024.Q3.0 through DXP...

Liferay DXP 2025.Q1.17 Liferay DXP 2024.Q1.20 Liferay DXP 2025.Q2.10 Liferay Portal and Liferay DXP exposes "Internal Server Error" in the response body when a login attempt is made with a deleted...

Liferay DXP 2025.Q1.17 Liferay Portal fixed on master branch Liferay DXP 2025.Q1.17 Liferay DXP 2025.Q2.12 Liferay DXP 2024.Q1.21 Liferay DXP 2024.Q1.21 Liferay DXP 2025.Q2.12 Liferay Portal...

N/A [Update 2025-09-18]: This vulnerability is now considered a false positive and has been officially rejected. The CVE record for CVE-2025-43774 has been updated to REJECTED status. The issue...

A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal and Liferay DXP that affects custom object attachment fields. This flaw allows an attacker to manipulate the...

Liferay Portal and Liferay DXP has a security vulnerability that allowing for improper access through the expandoTableLocalService. Liferay Portal fixed on master branch Liferay DXP 2025.Q2.1...

A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP due to insecure domain validation on analytics.cloud.domain.allowed, allowing an attacker to perform requests by change...

Liferay Portal and Liferay DXP allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled. Liferay Portal...

Liferay Portal fixed on master branch Liferay DXP 2025.Q2.6 Liferay DXP 2025.Q1.16 Liferay DXP 2024.Q1.21 Liferay Portal 7.4.0 through 7.4.3.132 Liferay DXP 2025.Q2.0 through 2025.Q2.5 Liferay DXP...

Liferay DXP 2025.Q2.9 Liferay Portal fixed on master branch Liferay DXP 2025.Q2.9 Liferay DXP 2025.Q1.16 Liferay DXP 2024.Q1.20 Liferay DXP 2024.Q1.20 Liferay DXP 2025.Q1.16 This issue was reported...

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows a remote authenticated user to inject JavaScript code via...

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows a remote authenticated user to inject JavaScript code via...

Liferay Portal fixed on master branch Liferay DXP 2025.Q2.8 Liferay DXP 2025.Q1.16 Liferay DXP 2024.Q1.20 Liferay Portal 7.4.0 through 7.4.3.132 Liferay DXP 2025.Q2.0 through 2025.Q2.7 Liferay DXP...

Liferay Portal 7.4.0 through 7.4.3.112 Liferay DXP 2024.Q1.1 through 2024.Q1.18 Liferay DXP 7.4 GA through U92 Liferay Portal 7.4.3.113 Liferay Portal 7.4.3.113 Liferay DXP 2024.Q1.19 Liferay DXP...

Liferay DXP 2025.Q2.3 Liferay Portal fixed on master branch Liferay DXP 2025.Q2.3 Liferay DXP 2025.Q1.15 Liferay DXP 2024.Q1.19 Liferay DXP 2024.Q1.19 Liferay DXP 2025.Q1.15 This issue was reported...

Liferay DXP 2024.Q1.19 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows a remote authenticated attacker to inject JavaScript code via...

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows a remote authenticated user to inject JavaScript code via snippet parameter. Liferay Portal...

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect Liferay...

Liferay Portal and Liferay DXP allow users to upload an unlimited amount of files through the object entries attachment fields, the files are stored in the document_library allowing an attacker to...

A Stored cross-site scripting vulnerability in the Liferay Portal and Liferay DXP allows an remote authenticated attacker to inject JavaScript into the...