Skip to Main Content
  • Ask
  • Blogs
  • Chat
  • Download
  • Feedback
  • Help
  • Learn
  • Projects
  • Ask - Test
  • Log In

Known Vulnerabilities

  • Overview
  • Reporting Security Issues
  • Known Vulnerabilities
  • Hall of Fame

Releases

  • Liferay Portal 7.4
  • Liferay Portal 7.3
  • Liferay Portal 7.2
  • Liferay Portal 7.1
  • Liferay Portal 7.0
  • Liferay Portal 6.2 CE
  • Liferay Faces
  • Liferay DXP 7.4
  • Liferay DXP 7.3
  • Liferay DXP 7.2
  • LIferay DXP 7.1
  • LIferay DXP 7.0
  • Liferay DXP 2025.Q3
  • Liferay DXP 2025.Q2
  • Liferay DXP 2025.Q1
  • Liferay DXP 2024.Q4
  • Liferay DXP 2024 Q3
  • Liferay DXP 2024 Q2
  • Liferay DXP 2024 Q1
  • Liferay DXP 2023.Q4
  • Liferay DXP 2023.Q3
RSS
  • CVE-2025-43776 The Process Builder's Configuration tab fails to properly escape stored JavaScript code

  • CVE-2025-43777 Internal server error message in the response body

  • CVE-2025-43778 Stored XSS on the name of a fieldset

  • CVE-2025-43773 Missing permission checks in expandoTableLocalService

  • CVE-2025-43747 SSRF in Analytics Cloud domain validation

  • CVE-2025-43744 Stored DOM-Based XSS in the Asset Publisher configuration UI

  • CVE-2025-43740 Stored XSS in message boards feature

  • CVE-2025-43737 Reflected XSS through JournalPortlet backUrl parameter

  • CVE-2025-43745 CSRF vulnerability in 'endpoint' parameter

  • CVE-2025-43746 Reflected XSS in Dynamic Data Mapping portletNamespace and Portlet_namespace parameter

  • CVE-2025-43757 Reflected XSS in Dynamic Data Mapping DDMPortlet_definition parameter

  • CVE-2025-43755 Stored XSS via GroupPagesPortlet_type parameter

Security advisories for Liferay's enterprise offerings (e.g., Liferay DXP) are only listed here since 2023. Historial advisories are availabe in the Help Center.

Community
Company
Feedback
Ask
Blogs
Meet
Open Source
Download
Events
Learn
Careers
Contact Us
Feedback
Help
Copyright © 2025 Liferay, Inc • Privacy Policy

Powered by Liferay™

This Website Uses Cookies

This website uses cookies and similar tools, some of which are provided by third parties (together “tools”). These tools enable us and the third parties to access and record certain user-related and activity data and to track your interactions with this website. These tools and the informationcollected are used to operate and secure this website, enhance performance, enable certain website features and functionality, analyze and improve website performance, and personalize user experience.

If you click “Accept All”, you allow the deployment of all these tools and collection of the information by us and the third parties for all these purposes.

If you click “Decline All” your IP address and other information may still be collected but only by tools (including third party tools) that are necessary to operate, secure and enable default website features and functionalities. Review and change your preferences by clicking the “Configurations” at any time.

Visit our Privacy Policy