Planned maintenance is scheduled for the week of June 15th - the exact date and time will be announced soon. See More Details
Known Vulnerabilities
-
Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal and Liferay DXP allows remote authenticated users to access a workflow definition by name via the API Liferay Portal 7.4.0...
-
This issue was reported by 4rth4s The organization selector in Liferay Portal and Liferay DXP does not check user permission, which allows remote authenticated users to obtain a list of all...
-
Reflected cross-site scripting (XSS) vulnerability in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via the URL in search bar portlet Liferay Portal...
-
SSRF vulnerability in FreeMarker templates in Liferay Portal and Liferay DXP allows template editors to bypass access validations via crafted URLs. Liferay Portal 7.4.0 through 7.4.3.132 Liferay...
-
Liferay DXP 2025.Q2.0 Liferay DXP 2025.Q1.6 Liferay Portal and Liferay DXP allows unauthenticated users (guests) to access via URL files uploaded by object entry and stored in document_library...
-
Liferay Portal and Liferay DXP allows any authenticated remote user to view other calendars by allowing them to enumerate the names of other users, given an attacker the possibility to send...
-
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows an remote non-authenticated attacker to inject JavaScript into the...
-
Liferay Portal and Liferay DXP allows a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web due to improper validation of user-supplied URLs. An attacker...
-
Liferay Portal 7.4.0 through 7.4.3.132 Liferay DXP 2025.Q1.0 through 2025.Q1.3 Liferay DXP 2024.Q4.0 through 2024.Q4.7 Liferay DXP 2024.Q3.1 through 2024.Q3.13 Liferay DXP 2024.Q2.0 throguh...
-
Liferay DXP 2025.Q1.4 Liferay DXP 2024.Q1.15 Liferay DXP 2025.Q2.0 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows an remote authenticated attacker...
-
Liferay Portal and Liferay DXP allows authenticated users without any permissions to access sensitive information of admin users using JSONWS APIs. Liferay Portal 7.4.0 through 7.4.3.131 Liferay...
-
Liferay Portal 7.4.3.132 Liferay DXP 2024.Q1.13 Liferay DXP 2024.Q3.10 Liferay DXP 2024.Q4.0 Liferay DXP 2025.Q1.0 Liferay Portal 7.4.3.86 through 7.4.3.131 Liferay DXP 2024.Q3.1 through 2024.Q3.9...
-
The Liferay Portal and Liferay DXP allows the upload of unrestricted files in the style books component that are processed within the environment enabling arbitrary code execution by attackers....
-
A Stored cross-site scripting vulnerability in the Liferay Portal and Liferay DXP allows an remote non-authenticated attacker to inject JavaScript into the text field from a web content. Liferay...
-
Liferay Portal 7.4.0 through 7.4.3.131 Liferay DXP 2024.Q4.0 through 2024.Q4.1 Liferay DXP 2024.Q3.1 through 2024.Q3.13 Liferay DXP 2024.Q2.0 throguh 2024.Q2.13 Liferay DXP 2024.Q1.1 through...
-
Liferay DXP 2025.Q1.0 Liferay DXP 2024.Q1.15 Liferay DXP 2025.Q2.0 Username enumeration vulnerability in Liferay Portal and Liferay DXP allows attackers to determine if an account exist in the...
-
Liferay Portal 7.4.0 through 7.4.3.131 Liferay DXP 2024.Q4.0 through 2024.Q4.3 Liferay DXP 2024.Q3.1 through 2024.Q3.12 Liferay DXP 2024.Q2.0 through 2024.Q2.13 Liferay DXP 2024.Q1.1 through...
-
User enumeration vulnerability in Liferay Portal and Liferay DXP allows remote attackers to determine if an account exist in the application via the create account page. Liferay Portal 7.4.0...
-
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows an remote non-authenticated attacker to inject JavaScript into the google_gadget. Liferay Portal...
-
Liferay Portal 7.4.3.132 Liferay Portal 7.4.3.132 Liferay DXP 2024.Q1.13 Liferay DXP 2024.Q4.5 Liferay DXP 2025.Q1.0 Liferay DXP 2024.Q4.5 Liferay DXP 2024.Q1.13 Liferay DXP 2025.Q1.0 A reflected...
-
The fragment preview functionality in Liferay Portal and Liferay DXP was found to be vulnerable to postMessage-based XSS because it allows a remote non-authenticated attacker to inject JavaScript...
-
Liferay Portal fixed on master branch Liferay DXP 2025.Q2.0 Liferay DXP 2025.Q1.1 Liferay DXP 2024.Q1.15 Liferay Portal 7.4.0 through 7.4.3.132 Liferay DXP 2025.Q1.0 Liferay DXP 2024.Q4.0 through...
-
Liferay DXP 2025.Q2.0 Liferay Portal fixed on master branch Liferay DXP 2025.Q2.0 Liferay DXP 2025.Q1.2 Liferay DXP 2024.Q1.15 Liferay DXP 2024.Q1.15 Liferay DXP 2025.Q1.2 Liferay Portal and...
-
Liferay Portal and Liferay DXP allow users to upload an unlimited amount of files through the forms, the files are stored in the document_library allowing an attacker to cause a potential DDoS....
-
Liferay Portal fixed on master branch Liferay DXP 2025.Q2.0 Liferay DXP 2025.Q1.2 Liferay DXP 2024.Q1.15 Liferay Portal 7.4.0 through 7.4.3.132 Liferay DXP 2025.Q1.0 through 2025.Q1.1 Liferay DXP...
-
Liferay DXP 2024.Q3.1 Liferay DXP 2024.Q4.0 Liferay DXP 2024.Q1.13 The data exposure vulnerability in Liferay Portal and Liferay DXP allows an unauthorized user to obtain entry data from forms....
-
Liferay DXP 2024.Q3.1 Liferay DXP 2024.Q1.13 Liferay DXP 2024.Q4.0 Dtro and TF1T of VietSunshine Cyber Security Services Cross-site scripting (XSS) vulnerability on Liferay Portal and Liferay DXP...
-
Liferay DXP 2024.Q4.0 Enumeration of ERC from object entry in Liferay Portal and Liferay DXP allow attackers to determine existent ERC in the application by exploit the time response. Liferay...
-
This issue was reported by milCERT AT and Lucas Machado from Devoteam Cyber Trust A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal...
-
Stored cross-site scripting (XSS) vulnerability in Liferay Portal and Liferay DXP allows remote attackers to execute arbitrary web script or HTML via components tab. Liferay Portal 7.4.0 through...
-
Stored cross-site scripting (XSS) vulnerability in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via remote app title field. Liferay Portal 7.4.0...
-
Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal and Liferay DXP allows remote authenticated users to from one virtual instance to view the audit events...
-
Liferay DXP 2024.Q1.3 Liferay DXP 2024.Q2.0 Liferay DXP 2023.Q4.9 This issue was reported by argon21 Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal...
-
In Liferay Portal and Liferay DXP (Liferay PaaS, and Liferay Self-Hosted), the Objects module does not restrict the use of Groovy scripts in Object actions for Admin Users. This allows remote...
-
Insufficient CSRF protection for omni-administrator users in Liferay Portal and Liferay DXP allows attackers to execute Cross-Site Request Forgery Liferay Portal 7.0.0 through 7.4.3.119 Liferay DXP...
-
Liferay Portal 7.4.3.110 Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q4.1 Liferay DXP 2023.Q3.5 Liferay DXP 7.3 Update 36 Liferay DXP 2023.Q3.1 through 2023.Q3.4 Liferay DXP 7.4 Update 51 through Update...
-
Severity 2 Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal and Liferay DXP allows remote attackers to (1) change user passwords, (2) shut down the server,...
Found a Bug?
If you have found, or think you have found a bug, help us to help you by letting us know!
Found a Security Vulnerability?
There's a different process available if you have a security issue to report...
Hall of Fame!
Raise your profile - report security vulnerabilities and enter the Hall of Fame!
Community
Company
Feedback