{"url":"http://public2.vulnerablecode.io/api/packages/29242?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.37","type":"maven","namespace":"com.liferay.portal","name":"release.portal.bom","version":"7.4.3.37","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"7.4.3.77-ga77","latest_non_vulnerable_version":"7.4.3.120-ga120","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/144153?format=json","vulnerability_id":"VCID-39dv-ngxr-vbaj","summary":"The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching for the object definition.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33947","reference_id":"","reference_type":"","scores":[{"value":"0.00268","scoring_system":"epss","scoring_elements":"0.50572","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33947"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33947","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33947"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33947","reference_id":"cve-2023-33947","reference_type":"","scores":[{"value":"2.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"},{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-22T15:44:18Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33947"},{"reference_url":"https://github.com/advisories/GHSA-769c-p92r-xgxj","reference_id":"GHSA-769c-p92r-xgxj","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-769c-p92r-xgxj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/382062?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.61","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-4m1t-nd28-43b2"},{"vulnerability":"VCID-55fq-h94e-kuep"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5sft-4ab1-9kcg"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6f8z-s1fz-57b2"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-99sz-6eag-3kff"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d49a-szjx-jub1"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-deaj-uts6-aqb5"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-eb9n-cwf1-fbga"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-evtz-a8xn-e7b6"},{"vulnerability":"VCID-ext6-8u2c-xufv"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hqwn-t5mr-13ab"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-pac3-4jrs-pqdg"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-ser9-x7zq-dqdv"},{"vulnerability":"VCID-te96-dz9q-z3cy"},{"vulnerability":"VCID-tkws-gscx-pff6"},{"vulnerability":"VCID-twb2-9ane-tfdw"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-u9gz-jcnn-syby"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"},{"vulnerability":"VCID-zc53-8p5g-2kcv"},{"vulnerability":"VCID-zkm4-bz55-9bb8"},{"vulnerability":"VCID-zn2s-8c79-x7h3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.61"}],"aliases":["CVE-2023-33947","GHSA-769c-p92r-xgxj"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-39dv-ngxr-vbaj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88609?format=json","vulnerability_id":"VCID-3cm9-v7g5-kfcn","summary":"A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote attackers to performs cross-origin request on behalf of the authenticated user via the endpoint parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43745","reference_id":"","reference_type":"","scores":[{"value":"0.00036","scoring_system":"epss","scoring_elements":"0.11072","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43745"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/037b58f96c9ded47960ab493a68d68aaf32b1a43","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/037b58f96c9ded47960ab493a68d68aaf32b1a43"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/2387ee78fd471ea1c1c4d696aa0cbb1bce72665e","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/2387ee78fd471ea1c1c4d696aa0cbb1bce72665e"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/729dfc202c9d2724b5f3f749ead14eb13832e101","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/729dfc202c9d2724b5f3f749ead14eb13832e101"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18275","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18275"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43745","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43745"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43745","reference_id":"CVE-2025-43745","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-19T19:15:28Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43745"},{"reference_url":"https://github.com/advisories/GHSA-7q33-gwcm-r6cj","reference_id":"GHSA-7q33-gwcm-r6cj","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-7q33-gwcm-r6cj"}],"fixed_packages":[],"aliases":["CVE-2025-43745","GHSA-7q33-gwcm-r6cj"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3cm9-v7g5-kfcn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/144092?format=json","vulnerability_id":"VCID-493t-ab65-pff3","summary":"The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33946","reference_id":"","reference_type":"","scores":[{"value":"0.00277","scoring_system":"epss","scoring_elements":"0.51483","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33946"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33946","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33946"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33946","reference_id":"cve-2023-33946","reference_type":"","scores":[{"value":"2.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"},{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-22T15:44:36Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33946"},{"reference_url":"https://github.com/advisories/GHSA-2868-ff44-43qv","reference_id":"GHSA-2868-ff44-43qv","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-2868-ff44-43qv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/381978?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.49","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-39dv-ngxr-vbaj"},{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-4m1t-nd28-43b2"},{"vulnerability":"VCID-55fq-h94e-kuep"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5sft-4ab1-9kcg"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6f8z-s1fz-57b2"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-99sz-6eag-3kff"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d49a-szjx-jub1"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-deaj-uts6-aqb5"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-eb9n-cwf1-fbga"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-evtz-a8xn-e7b6"},{"vulnerability":"VCID-ext6-8u2c-xufv"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hqwn-t5mr-13ab"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-pac3-4jrs-pqdg"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-s59m-uwgm-d7ed"},{"vulnerability":"VCID-ser9-x7zq-dqdv"},{"vulnerability":"VCID-te96-dz9q-z3cy"},{"vulnerability":"VCID-tkws-gscx-pff6"},{"vulnerability":"VCID-twb2-9ane-tfdw"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-u9gz-jcnn-syby"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"},{"vulnerability":"VCID-zc53-8p5g-2kcv"},{"vulnerability":"VCID-zkm4-bz55-9bb8"},{"vulnerability":"VCID-zn2s-8c79-x7h3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.49"}],"aliases":["CVE-2023-33946","GHSA-2868-ff44-43qv"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-493t-ab65-pff3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/102859?format=json","vulnerability_id":"VCID-4m1t-nd28-43b2","summary":"Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified their email address, which allows remote users to access and edit content via the API.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62259","reference_id":"","reference_type":"","scores":[{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.18104","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62259"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62259","reference_id":"CVE-2025-62259","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-28T19:47:44Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62259"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62259","reference_id":"CVE-2025-62259","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62259"},{"reference_url":"https://github.com/advisories/GHSA-gv7w-jh8g-vr73","reference_id":"GHSA-gv7w-jh8g-vr73","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gv7w-jh8g-vr73"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/34840?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110"},{"url":"http://public2.vulnerablecode.io/api/packages/372003?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-qxsh-hm7q-5ban"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112"}],"aliases":["CVE-2025-62259","GHSA-gv7w-jh8g-vr73"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4m1t-nd28-43b2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/102731?format=json","vulnerability_id":"VCID-55fq-h94e-kuep","summary":"By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated by changing the redirect URL security from IP to domain.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62266","reference_id":"","reference_type":"","scores":[{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13586","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62266"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62256","reference_id":"CVE-2025-62256","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-30T19:06:36Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62256"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257","reference_id":"CVE-2025-62257","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62266","reference_id":"CVE-2025-62266","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62266"},{"reference_url":"https://github.com/advisories/GHSA-f5vh-4rj2-w8r8","reference_id":"GHSA-f5vh-4rj2-w8r8","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-f5vh-4rj2-w8r8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/34840?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110"},{"url":"http://public2.vulnerablecode.io/api/packages/372003?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-qxsh-hm7q-5ban"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112"}],"aliases":["CVE-2025-62266","GHSA-f5vh-4rj2-w8r8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-55fq-h94e-kuep"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88802?format=json","vulnerability_id":"VCID-5rce-t9wm-4ycx","summary":"Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the object entries attachment fields, the files are stored in the document_library allowing an attacker to cause a potential DDoS.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43752","reference_id":"","reference_type":"","scores":[{"value":"0.00119","scoring_system":"epss","scoring_elements":"0.30396","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43752"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/45dda30252d83912307491d8ed8802577871fa25","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/45dda30252d83912307491d8ed8802577871fa25"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/f3e4723acdf15d3f690d401d6eb6a5653e5be391","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/f3e4723acdf15d3f690d401d6eb6a5653e5be391"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/fffed67b3fd1cc6071fd25a9b104b7691ffea2f8","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/fffed67b3fd1cc6071fd25a9b104b7691ffea2f8"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18188","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18188"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43752","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43752"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43752","reference_id":"CVE-2025-43752","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-22T11:27:55Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43752"},{"reference_url":"https://github.com/advisories/GHSA-qpp6-f3qj-rggq","reference_id":"GHSA-qpp6-f3qj-rggq","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-qpp6-f3qj-rggq"}],"fixed_packages":[],"aliases":["CVE-2025-43752","GHSA-qpp6-f3qj-rggq"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5rce-t9wm-4ycx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/143729?format=json","vulnerability_id":"VCID-5sft-4ab1-9kcg","summary":"Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's (1) First Name, (2) Middle Name, (3) Last Name, or (4) Job Title text field.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33943","reference_id":"","reference_type":"","scores":[{"value":"0.00296","scoring_system":"epss","scoring_elements":"0.53313","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33943"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33943","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33943"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33943","reference_id":"cve-2023-33943","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-22T15:46:56Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33943"},{"reference_url":"https://github.com/advisories/GHSA-p9xg-9378-cqp7","reference_id":"GHSA-p9xg-9378-cqp7","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-p9xg-9378-cqp7"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/381980?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.63","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-4m1t-nd28-43b2"},{"vulnerability":"VCID-55fq-h94e-kuep"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6f8z-s1fz-57b2"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-99sz-6eag-3kff"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d49a-szjx-jub1"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-deaj-uts6-aqb5"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-eb9n-cwf1-fbga"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-evtz-a8xn-e7b6"},{"vulnerability":"VCID-ext6-8u2c-xufv"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hqwn-t5mr-13ab"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-pac3-4jrs-pqdg"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-ser9-x7zq-dqdv"},{"vulnerability":"VCID-te96-dz9q-z3cy"},{"vulnerability":"VCID-tkws-gscx-pff6"},{"vulnerability":"VCID-twb2-9ane-tfdw"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-u9gz-jcnn-syby"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"},{"vulnerability":"VCID-zc53-8p5g-2kcv"},{"vulnerability":"VCID-zkm4-bz55-9bb8"},{"vulnerability":"VCID-zn2s-8c79-x7h3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.63"}],"aliases":["CVE-2023-33943","GHSA-p9xg-9378-cqp7"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5sft-4ab1-9kcg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/102779?format=json","vulnerability_id":"VCID-5ytw-d875-3yfe","summary":"Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62257","reference_id":"","reference_type":"","scores":[{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03996","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62257"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/45cffd5030ab78e8b005d9cfd6284311da978c68","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/45cffd5030ab78e8b005d9cfd6284311da978c68"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/924a0a47007665693fe2d29623cb48a426a80266","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/924a0a47007665693fe2d29623cb48a426a80266"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/d21627ac07561c5063f611be631e63ff502ec8e7","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/d21627ac07561c5063f611be631e63ff502ec8e7"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-17692","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-17692"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257","reference_id":"CVE-2025-62257","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-30T14:08:10Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62257","reference_id":"CVE-2025-62257","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62257"},{"reference_url":"https://github.com/advisories/GHSA-8hw3-ghwv-crfh","reference_id":"GHSA-8hw3-ghwv-crfh","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8hw3-ghwv-crfh"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/34919?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120"}],"aliases":["CVE-2025-62257","GHSA-8hw3-ghwv-crfh"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5ytw-d875-3yfe"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88836?format=json","vulnerability_id":"VCID-69x9-5buz-1yht","summary":"The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file is downloaded.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43824","reference_id":"","reference_type":"","scores":[{"value":"0.00036","scoring_system":"epss","scoring_elements":"0.1107","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43824"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43824","reference_id":"CVE-2025-43824","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-07T15:52:30Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43824"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43824","reference_id":"CVE-2025-43824","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43824"},{"reference_url":"https://github.com/advisories/GHSA-pfxj-gvqg-mj44","reference_id":"GHSA-pfxj-gvqg-mj44","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-pfxj-gvqg-mj44"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33988?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112"}],"aliases":["CVE-2025-43824","GHSA-pfxj-gvqg-mj44"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-69x9-5buz-1yht"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/103031?format=json","vulnerability_id":"VCID-6f8z-s1fz-57b2","summary":"CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62258","reference_id":"","reference_type":"","scores":[{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06808","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62258"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"7.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62258","reference_id":"CVE-2025-62258","reference_type":"","scores":[{"value":"7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"7.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-28T14:59:44Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62258"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62258","reference_id":"CVE-2025-62258","reference_type":"","scores":[{"value":"7.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62258"},{"reference_url":"https://github.com/advisories/GHSA-gh4w-8qgq-8w9r","reference_id":"GHSA-gh4w-8qgq-8w9r","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gh4w-8qgq-8w9r"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/34841?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108"},{"url":"http://public2.vulnerablecode.io/api/packages/372003?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-qxsh-hm7q-5ban"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112"}],"aliases":["CVE-2025-62258","GHSA-gh4w-8qgq-8w9r"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6f8z-s1fz-57b2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37371?format=json","vulnerability_id":"VCID-6jsv-kw7h-9yeu","summary":"The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38002","reference_id":"","reference_type":"","scores":[{"value":"0.04275","scoring_system":"epss","scoring_elements":"0.89084","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38002"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38002","reference_id":"","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38002"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-38002","reference_id":"CVE-2024-38002","reference_type":"","scores":[{"value":"9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:21:03Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-38002"},{"reference_url":"https://github.com/advisories/GHSA-3mfq-fp2f-vwqh","reference_id":"GHSA-3mfq-fp2f-vwqh","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-3mfq-fp2f-vwqh"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33988?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112"}],"aliases":["CVE-2024-38002","GHSA-3mfq-fp2f-vwqh"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6jsv-kw7h-9yeu"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88502?format=json","vulnerability_id":"VCID-73u9-6qzv-t7f7","summary":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScrip in the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_assetTagNames parameter","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43741","reference_id":"","reference_type":"","scores":[{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.1402","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43741"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/264f4f91aa4f8373c5a9cc44420edf1689384cbb","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/264f4f91aa4f8373c5a9cc44420edf1689384cbb"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18193","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18193"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43741","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43741"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43741","reference_id":"CVE-2025-43741","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T15:16:53Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43741"},{"reference_url":"https://github.com/advisories/GHSA-j6p8-g3rj-ghpm","reference_id":"GHSA-j6p8-g3rj-ghpm","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-j6p8-g3rj-ghpm"}],"fixed_packages":[],"aliases":["CVE-2025-43741","GHSA-j6p8-g3rj-ghpm"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-73u9-6qzv-t7f7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88366?format=json","vulnerability_id":"VCID-7bjy-2h8a-ukbe","summary":"Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allow remote attackers to inject arbitrary web script or HTML via any rich text field in a web content article.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43826","reference_id":"","reference_type":"","scores":[{"value":"0.00033","scoring_system":"epss","scoring_elements":"0.10191","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43826"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-17939","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-17939"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43826","reference_id":"CVE-2025-43826","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-01T15:03:14Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43826"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43826","reference_id":"CVE-2025-43826","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43826"},{"reference_url":"https://github.com/advisories/GHSA-qh92-cr5f-3595","reference_id":"GHSA-qh92-cr5f-3595","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qh92-cr5f-3595"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/34021?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.113-ga113","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.113-ga113"},{"url":"http://public2.vulnerablecode.io/api/packages/34919?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120"}],"aliases":["CVE-2025-43826","GHSA-qh92-cr5f-3595"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-7bjy-2h8a-ukbe"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/147657?format=json","vulnerability_id":"VCID-99sz-6eag-3kff","summary":"Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 18 through 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a document's “Title” text field.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-47795","reference_id":"","reference_type":"","scores":[{"value":"0.00458","scoring_system":"epss","scoring_elements":"0.64421","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-47795"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47795","reference_id":"cve-2023-47795","reference_type":"","scores":[{"value":"9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T18:14:14Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47795"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47795","reference_id":"CVE-2023-47795","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47795"},{"reference_url":"https://github.com/advisories/GHSA-q2cv-7j58-rfmj","reference_id":"GHSA-q2cv-7j58-rfmj","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-q2cv-7j58-rfmj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/29251?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.102","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-4m1t-nd28-43b2"},{"vulnerability":"VCID-55fq-h94e-kuep"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6f8z-s1fz-57b2"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d49a-szjx-jub1"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-eb9n-cwf1-fbga"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-evtz-a8xn-e7b6"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-k7dn-nb9d-ckdk"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-qxsh-hm7q-5ban"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-tkws-gscx-pff6"},{"vulnerability":"VCID-twb2-9ane-tfdw"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-u9gz-jcnn-syby"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"},{"vulnerability":"VCID-zn2s-8c79-x7h3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.102"}],"aliases":["CVE-2023-47795","GHSA-q2cv-7j58-rfmj"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-99sz-6eag-3kff"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88463?format=json","vulnerability_id":"VCID-beqe-x5p8-23b9","summary":"A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload more than 300kb profile picture into the user profile. This size more than the noted max 300kb size. This extra amount of data can make Liferay slower.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43736","reference_id":"","reference_type":"","scores":[{"value":"0.00668","scoring_system":"epss","scoring_elements":"0.71759","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43736"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/RE:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/ab8932bee29df7df377c468f662d55e624d9390d","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/RE:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/ab8932bee29df7df377c468f662d55e624d9390d"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18220","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/RE:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18220"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43736","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/RE:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43736"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43736","reference_id":"CVE-2025-43736","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/RE:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-12T18:15:44Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43736"},{"reference_url":"https://github.com/advisories/GHSA-cg99-m88x-422c","reference_id":"GHSA-cg99-m88x-422c","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-cg99-m88x-422c"}],"fixed_packages":[],"aliases":["CVE-2025-43736","GHSA-cg99-m88x-422c"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-beqe-x5p8-23b9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88628?format=json","vulnerability_id":"VCID-c2hc-pbr7-2yhz","summary":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43731","reference_id":"","reference_type":"","scores":[{"value":"0.00048","scoring_system":"epss","scoring_elements":"0.15365","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43731"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/41708aa542c103521427ecf06f4b20cb37c65ecf","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/41708aa542c103521427ecf06f4b20cb37c65ecf"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/cd1c692dfed3bbebe10074ecb89c561893fffaf9","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/cd1c692dfed3bbebe10074ecb89c561893fffaf9"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/f23921fc93cf713f27ed9c4d31b8c1854c0e2abb","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/f23921fc93cf713f27ed9c4d31b8c1854c0e2abb"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18217","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18217"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18219","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18219"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43731","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43731"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43731","reference_id":"CVE-2025-43731","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-18T18:37:36Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43731"},{"reference_url":"https://github.com/advisories/GHSA-3p2m-574v-v257","reference_id":"GHSA-3p2m-574v-v257","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-3p2m-574v-v257"}],"fixed_packages":[],"aliases":["CVE-2025-43731","GHSA-3p2m-574v-v257"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-c2hc-pbr7-2yhz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88914?format=json","vulnerability_id":"VCID-d9qm-h8q2-sfda","summary":"Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded in the form and stored in document_library","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43749","reference_id":"","reference_type":"","scores":[{"value":"0.00141","scoring_system":"epss","scoring_elements":"0.3402","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43749"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/5919534a979a97444172f49705b7a224e372e625","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/5919534a979a97444172f49705b7a224e372e625"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/b88e7e0912d27cc166fc788b642616ece9e8c484","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/b88e7e0912d27cc166fc788b642616ece9e8c484"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18176","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18176"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43749","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43749"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43749","reference_id":"CVE-2025-43749","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T15:12:36Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43749"},{"reference_url":"https://github.com/advisories/GHSA-5fx5-cff6-f3fp","reference_id":"GHSA-5fx5-cff6-f3fp","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-5fx5-cff6-f3fp"}],"fixed_packages":[],"aliases":["CVE-2025-43749","GHSA-5fx5-cff6-f3fp"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-d9qm-h8q2-sfda"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/135493?format=json","vulnerability_id":"VCID-deaj-uts6-aqb5","summary":"Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-42498","reference_id":"","reference_type":"","scores":[{"value":"0.0044","scoring_system":"epss","scoring_elements":"0.63626","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-42498"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42498","reference_id":"cve-2023-42498","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-26T17:54:30Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42498"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42498","reference_id":"CVE-2023-42498","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42498"},{"reference_url":"https://github.com/advisories/GHSA-73x3-8mrg-5r93","reference_id":"GHSA-73x3-8mrg-5r93","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-73x3-8mrg-5r93"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/29233?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-4m1t-nd28-43b2"},{"vulnerability":"VCID-55fq-h94e-kuep"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6f8z-s1fz-57b2"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-99sz-6eag-3kff"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d49a-szjx-jub1"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-eb9n-cwf1-fbga"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-evtz-a8xn-e7b6"},{"vulnerability":"VCID-ext6-8u2c-xufv"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hqwn-t5mr-13ab"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-k7dn-nb9d-ckdk"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-qxsh-hm7q-5ban"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-tkws-gscx-pff6"},{"vulnerability":"VCID-twb2-9ane-tfdw"},{"vulnerability":"VCID-twyc-srx8-fudj"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-u9gz-jcnn-syby"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"},{"vulnerability":"VCID-zn2s-8c79-x7h3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98"}],"aliases":["CVE-2023-42498","GHSA-73x3-8mrg-5r93"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-deaj-uts6-aqb5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88837?format=json","vulnerability_id":"VCID-dztj-3hzz-3bcg","summary":"Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92 allow remote attackers to inject arbitrary web script or HTML via crafted payload injected into a Terms and Condition's Name text field to (1) Payment Terms, or (2) the Delivery Term on the view order page.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43822","reference_id":"","reference_type":"","scores":[{"value":"0.00031","scoring_system":"epss","scoring_elements":"0.093","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43822"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43822","reference_id":"CVE-2025-43822","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-08T14:34:11Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43822"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43822","reference_id":"CVE-2025-43822","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43822"},{"reference_url":"https://github.com/advisories/GHSA-4mqx-4p8g-995w","reference_id":"GHSA-4mqx-4p8g-995w","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-4mqx-4p8g-995w"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33988?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112"}],"aliases":["CVE-2025-43822","GHSA-4mqx-4p8g-995w"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dztj-3hzz-3bcg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88521?format=json","vulnerability_id":"VCID-eb9n-cwf1-fbga","summary":"Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to access arbitrary CSS and JSS files and load the files multiple times via the query string in a URL.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43813","reference_id":"","reference_type":"","scores":[{"value":"0.00198","scoring_system":"epss","scoring_elements":"0.41877","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43813"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/7acad68976e831a0f3b855752ad7874e03be1d43","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/7acad68976e831a0f3b855752ad7874e03be1d43"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9159075ede8a1656bf67a893a486c93a9e9fe70a","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9159075ede8a1656bf67a893a486c93a9e9fe70a"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9be57d358ae0f6181a138ce08f52b80e4b14778a","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9be57d358ae0f6181a138ce08f52b80e4b14778a"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-17865","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-17865"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43813","reference_id":"CVE-2025-43813","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-09-30T14:45:14Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43813"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43813","reference_id":"CVE-2025-43813","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43813"},{"reference_url":"https://github.com/advisories/GHSA-2hm7-r8f3-423h","reference_id":"GHSA-2hm7-r8f3-423h","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-2hm7-r8f3-423h"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/34000?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108-ga108","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108-ga108"},{"url":"http://public2.vulnerablecode.io/api/packages/372003?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-qxsh-hm7q-5ban"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112"}],"aliases":["CVE-2025-43813","GHSA-2hm7-r8f3-423h"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-eb9n-cwf1-fbga"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88377?format=json","vulnerability_id":"VCID-ep8t-7k2h-2kdp","summary":"Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated remote user to view other calendars by allowing them to enumerate the names of other users, given an attacker the possibility to send phishing to these users.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43743","reference_id":"","reference_type":"","scores":[{"value":"0.00081","scoring_system":"epss","scoring_elements":"0.23872","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43743"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/02528147664475cd9f7205cd8bc05dfd43832201","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/02528147664475cd9f7205cd8bc05dfd43832201"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/144e4a276e456c4b7a0831ff038241f82a9181db","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/144e4a276e456c4b7a0831ff038241f82a9181db"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/1513ed29f830c9119ee6be623ae783e545da4845","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/1513ed29f830c9119ee6be623ae783e545da4845"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/1e368205c710403e76749e38127419780acdda9d","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/1e368205c710403e76749e38127419780acdda9d"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/7d6e1bccb62a41e944e0459d2c4b1eb9fdb31b8e","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/7d6e1bccb62a41e944e0459d2c4b1eb9fdb31b8e"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9a88f7fa98f9fc11a9eab444a256204cccc82b77","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9a88f7fa98f9fc11a9eab444a256204cccc82b77"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9aba859a6956786bcd8ce434ef063eed01b5ec6e","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9aba859a6956786bcd8ce434ef063eed01b5ec6e"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/bd89933cc9022a98fc34b562ce3573a58f14cf38","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/bd89933cc9022a98fc34b562ce3573a58f14cf38"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/d999a8e1902e88fdd7a26758f137925d969a639d","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/d999a8e1902e88fdd7a26758f137925d969a639d"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18206","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18206"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43743","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43743"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43743","reference_id":"CVE-2025-43743","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-19T19:28:02Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43743"},{"reference_url":"https://github.com/advisories/GHSA-g4vp-4gqr-7v8c","reference_id":"GHSA-g4vp-4gqr-7v8c","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-g4vp-4gqr-7v8c"}],"fixed_packages":[],"aliases":["CVE-2025-43743","GHSA-g4vp-4gqr-7v8c"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ep8t-7k2h-2kdp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/127620?format=json","vulnerability_id":"VCID-epds-vwku-cyed","summary":"A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-3760","reference_id":"","reference_type":"","scores":[{"value":"0.00157","scoring_system":"epss","scoring_elements":"0.36299","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-3760"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3760","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3760"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3760","reference_id":"CVE-2025-3760","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-17T13:22:03Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3760"},{"reference_url":"https://github.com/advisories/GHSA-qhp6-vp7c-g7xp","reference_id":"GHSA-qhp6-vp7c-g7xp","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-qhp6-vp7c-g7xp"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/376541?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-jpgh-rqqn-x7ge"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132"}],"aliases":["CVE-2025-3760","GHSA-qhp6-vp7c-g7xp"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-epds-vwku-cyed"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/41626?format=json","vulnerability_id":"VCID-evtz-a8xn-e7b6","summary":"Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26273","reference_id":"","reference_type":"","scores":[{"value":"0.02193","scoring_system":"epss","scoring_elements":"0.84758","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26273"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26273","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26273"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26273","reference_id":"CVE-2024-26273","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:18:21Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26273"},{"reference_url":"https://github.com/advisories/GHSA-hmrx-6pr5-hpwj","reference_id":"GHSA-hmrx-6pr5-hpwj","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-hmrx-6pr5-hpwj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/371940?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.104","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-4m1t-nd28-43b2"},{"vulnerability":"VCID-55fq-h94e-kuep"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6f8z-s1fz-57b2"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-eb9n-cwf1-fbga"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-k7dn-nb9d-ckdk"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-qxsh-hm7q-5ban"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-tkws-gscx-pff6"},{"vulnerability":"VCID-twb2-9ane-tfdw"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-u9gz-jcnn-syby"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.104"}],"aliases":["CVE-2024-26273","GHSA-hmrx-6pr5-hpwj"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-evtz-a8xn-e7b6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/102599?format=json","vulnerability_id":"VCID-ext6-8u2c-xufv","summary":"Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62261","reference_id":"","reference_type":"","scores":[{"value":"0.00025","scoring_system":"epss","scoring_elements":"0.07643","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62261"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/b228c7878f2ed5ad8dbc1ff7ec9b5e6d53bb4b5c","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/b228c7878f2ed5ad8dbc1ff7ec9b5e6d53bb4b5c"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-17785","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-17785"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62261","reference_id":"CVE-2025-62261","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-28T14:27:39Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62261"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62261","reference_id":"CVE-2025-62261","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62261"},{"reference_url":"https://github.com/advisories/GHSA-xcj6-xpjg-c4xr","reference_id":"GHSA-xcj6-xpjg-c4xr","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xcj6-xpjg-c4xr"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/29164?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-4m1t-nd28-43b2"},{"vulnerability":"VCID-55fq-h94e-kuep"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6f8z-s1fz-57b2"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-99sz-6eag-3kff"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d49a-szjx-jub1"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-eb9n-cwf1-fbga"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-evtz-a8xn-e7b6"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-k7dn-nb9d-ckdk"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-qxsh-hm7q-5ban"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-tkws-gscx-pff6"},{"vulnerability":"VCID-twb2-9ane-tfdw"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-u9gz-jcnn-syby"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"},{"vulnerability":"VCID-zn2s-8c79-x7h3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100"}],"aliases":["CVE-2025-62261","GHSA-xcj6-xpjg-c4xr"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ext6-8u2c-xufv"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88680?format=json","vulnerability_id":"VCID-f6z5-3pp9-7qey","summary":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43757","reference_id":"","reference_type":"","scores":[{"value":"0.00041","scoring_system":"epss","scoring_elements":"0.12693","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43757"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/0114bb60238e5ac74b90fba37fa9748c4e6c114a","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/0114bb60238e5ac74b90fba37fa9748c4e6c114a"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/0837982b91c5f9e837ec11a93f7e0986e00738fa","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/0837982b91c5f9e837ec11a93f7e0986e00738fa"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/45492d30bad4084f36e87ef11c29a5bf5fb4046d","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/45492d30bad4084f36e87ef11c29a5bf5fb4046d"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/90396a201d05be5840f99f7487578aab253dfa87","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/90396a201d05be5840f99f7487578aab253dfa87"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9e0026c8aa444937a2bfd079bcca35ab3dd18f5a","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9e0026c8aa444937a2bfd079bcca35ab3dd18f5a"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/cc46176ba4142f470d540f2343b36f12a678a240","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/cc46176ba4142f470d540f2343b36f12a678a240"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/d001c5ba8a1477755d7d83b8a00aba23036b045b","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/d001c5ba8a1477755d7d83b8a00aba23036b045b"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/e83d102bf00af3aa4396c1fc5a1d6b3842ccaeb1","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/e83d102bf00af3aa4396c1fc5a1d6b3842ccaeb1"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18259","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18259"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43757","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43757"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43757","reference_id":"CVE-2025-43757","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T20:00:20Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43757"},{"reference_url":"https://github.com/advisories/GHSA-62pf-hcwj-rcfc","reference_id":"GHSA-62pf-hcwj-rcfc","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-62pf-hcwj-rcfc"}],"fixed_packages":[],"aliases":["CVE-2025-43757","GHSA-62pf-hcwj-rcfc"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-f6z5-3pp9-7qey"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/102404?format=json","vulnerability_id":"VCID-gfwc-qjpr-6fgf","summary":"Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted <iframe> injected into a blog entry's “Content” text field \n\nThe Blogs widget in Liferay DXP does not add the sandbox attribute to <iframe> elements, which allows remote attackers to access the parent page via scripts and links in the frame page.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62265","reference_id":"","reference_type":"","scores":[{"value":"0.00031","scoring_system":"epss","scoring_elements":"0.093","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62265"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62265","reference_id":"CVE-2025-62265","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-30T19:04:40Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62265"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62265","reference_id":"CVE-2025-62265","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62265"},{"reference_url":"https://github.com/advisories/GHSA-56jv-4ww3-65mw","reference_id":"GHSA-56jv-4ww3-65mw","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-56jv-4ww3-65mw"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33988?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112"}],"aliases":["CVE-2025-62265","GHSA-56jv-4ww3-65mw"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gfwc-qjpr-6fgf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/60411?format=json","vulnerability_id":"VCID-gngs-dm98-eqc2","summary":"Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-11993","reference_id":"","reference_type":"","scores":[{"value":"0.00175","scoring_system":"epss","scoring_elements":"0.38804","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-11993"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"4.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11993","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"4.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11993"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993","reference_id":"CVE-2024-11993","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"4.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-17T21:24:48Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993"},{"reference_url":"https://github.com/advisories/GHSA-4hxr-28mv-q729","reference_id":"GHSA-4hxr-28mv-q729","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-4hxr-28mv-q729"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/372328?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.39","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-39dv-ngxr-vbaj"},{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-493t-ab65-pff3"},{"vulnerability":"VCID-4m1t-nd28-43b2"},{"vulnerability":"VCID-55fq-h94e-kuep"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5sft-4ab1-9kcg"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6f8z-s1fz-57b2"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-99sz-6eag-3kff"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-deaj-uts6-aqb5"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-eb9n-cwf1-fbga"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-evtz-a8xn-e7b6"},{"vulnerability":"VCID-ext6-8u2c-xufv"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hqwn-t5mr-13ab"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-k56t-ry18-zbg4"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-ser9-x7zq-dqdv"},{"vulnerability":"VCID-tkws-gscx-pff6"},{"vulnerability":"VCID-twb2-9ane-tfdw"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-u9gz-jcnn-syby"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"},{"vulnerability":"VCID-zc53-8p5g-2kcv"},{"vulnerability":"VCID-zkm4-bz55-9bb8"},{"vulnerability":"VCID-zn2s-8c79-x7h3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.39"}],"aliases":["CVE-2024-11993","GHSA-4hxr-28mv-q729"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gngs-dm98-eqc2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/102498?format=json","vulnerability_id":"VCID-hqwn-t5mr-13ab","summary":"Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing a request that returns a large number of objects.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62260","reference_id":"","reference_type":"","scores":[{"value":"0.00169","scoring_system":"epss","scoring_elements":"0.37906","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62260"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/5f5c73913b0e7287f7de0b4e19987cc57844b691","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/5f5c73913b0e7287f7de0b4e19987cc57844b691"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-17800","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-17800"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62260","reference_id":"CVE-2025-62260","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-28T15:01:15Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62260"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62260","reference_id":"CVE-2025-62260","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62260"},{"reference_url":"https://github.com/advisories/GHSA-vgqx-447m-wvcj","reference_id":"GHSA-vgqx-447m-wvcj","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vgqx-447m-wvcj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/29164?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-4m1t-nd28-43b2"},{"vulnerability":"VCID-55fq-h94e-kuep"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6f8z-s1fz-57b2"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-99sz-6eag-3kff"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d49a-szjx-jub1"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-eb9n-cwf1-fbga"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-evtz-a8xn-e7b6"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-k7dn-nb9d-ckdk"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-qxsh-hm7q-5ban"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-tkws-gscx-pff6"},{"vulnerability":"VCID-twb2-9ane-tfdw"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-u9gz-jcnn-syby"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"},{"vulnerability":"VCID-zn2s-8c79-x7h3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100"}],"aliases":["CVE-2025-62260","GHSA-vgqx-447m-wvcj"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hqwn-t5mr-13ab"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88884?format=json","vulnerability_id":"VCID-hthn-qn9g-u3dv","summary":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43735","reference_id":"","reference_type":"","scores":[{"value":"0.00208","scoring_system":"epss","scoring_elements":"0.43261","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43735"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/64d19e457ffc9876fd159a907741618843d7aadb","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/64d19e457ffc9876fd159a907741618843d7aadb"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18158","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18158"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43735","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43735"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43735","reference_id":"CVE-2025-43735","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-12T13:31:05Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43735"},{"reference_url":"https://github.com/advisories/GHSA-222w-xmc5-jhp3","reference_id":"GHSA-222w-xmc5-jhp3","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-222w-xmc5-jhp3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/376541?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-jpgh-rqqn-x7ge"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132"}],"aliases":["CVE-2025-43735","GHSA-222w-xmc5-jhp3"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hthn-qn9g-u3dv"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88492?format=json","vulnerability_id":"VCID-j2r3-g95d-hued","summary":"Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a web content structure's Name text field","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43812","reference_id":"","reference_type":"","scores":[{"value":"0.00033","scoring_system":"epss","scoring_elements":"0.10191","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43812"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/7466c9ba0126a4a93c85913cbec9b11c687deb36","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/7466c9ba0126a4a93c85913cbec9b11c687deb36"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-17942","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-17942"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43812","reference_id":"CVE-2025-43812","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-30T14:45:45Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43812"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43812","reference_id":"CVE-2025-43812","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43812"},{"reference_url":"https://github.com/advisories/GHSA-jv8x-mm3v-75r7","reference_id":"GHSA-jv8x-mm3v-75r7","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-jv8x-mm3v-75r7"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33988?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112"}],"aliases":["CVE-2025-43812","GHSA-jv8x-mm3v-75r7"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-j2r3-g95d-hued"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/166683?format=json","vulnerability_id":"VCID-k56t-ry18-zbg4","summary":"The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42127","reference_id":"","reference_type":"","scores":[{"value":"0.00316","scoring_system":"epss","scoring_elements":"0.55156","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42127"},{"reference_url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42127","reference_id":"cve-2022-42127","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:27:47Z/"}],"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42127"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42127","reference_id":"CVE-2022-42127","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42127"},{"reference_url":"https://github.com/advisories/GHSA-5x9h-p2gx-35mg","reference_id":"GHSA-5x9h-p2gx-35mg","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5x9h-p2gx-35mg"},{"reference_url":"http://liferay.com","reference_id":"liferay.com","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:27:47Z/"}],"url":"http://liferay.com"},{"reference_url":"https://issues.liferay.com/browse/LPE-17607","reference_id":"LPE-17607","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:27:47Z/"}],"url":"https://issues.liferay.com/browse/LPE-17607"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/27862?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-39dv-ngxr-vbaj"},{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-493t-ab65-pff3"},{"vulnerability":"VCID-4m1t-nd28-43b2"},{"vulnerability":"VCID-55fq-h94e-kuep"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5sft-4ab1-9kcg"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6f8z-s1fz-57b2"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-99sz-6eag-3kff"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d49a-szjx-jub1"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-deaj-uts6-aqb5"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-eb9n-cwf1-fbga"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-evtz-a8xn-e7b6"},{"vulnerability":"VCID-ext6-8u2c-xufv"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hqwn-t5mr-13ab"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-pac3-4jrs-pqdg"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-s59m-uwgm-d7ed"},{"vulnerability":"VCID-ser9-x7zq-dqdv"},{"vulnerability":"VCID-te96-dz9q-z3cy"},{"vulnerability":"VCID-tkws-gscx-pff6"},{"vulnerability":"VCID-twb2-9ane-tfdw"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-u9gz-jcnn-syby"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"},{"vulnerability":"VCID-zc53-8p5g-2kcv"},{"vulnerability":"VCID-zkm4-bz55-9bb8"},{"vulnerability":"VCID-zn2s-8c79-x7h3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48"}],"aliases":["CVE-2022-42127","GHSA-5x9h-p2gx-35mg"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-k56t-ry18-zbg4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/127548?format=json","vulnerability_id":"VCID-kke1-d8nw-tyhj","summary":"Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-3639","reference_id":"","reference_type":"","scores":[{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13763","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-3639"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/383a4001cfdf533eb077ed6f03bc5f8fed27cf05","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/383a4001cfdf533eb077ed6f03bc5f8fed27cf05"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/774c89c853d4b9d9abb61d6e079dab21f582cc78","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/774c89c853d4b9d9abb61d6e079dab21f582cc78"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/7a70daf60416d536a45fe137d54e1054e9394fa7","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/7a70daf60416d536a45fe137d54e1054e9394fa7"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/a0265c3847af01a37d2a9ad1560e4408f2856518","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/a0265c3847af01a37d2a9ad1560e4408f2856518"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/a5081fefaffdd86a9306320c46e91f98973c39cb","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/a5081fefaffdd86a9306320c46e91f98973c39cb"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/d2806ad26cb194d0c7d654f9c447857e05dd44b2","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/d2806ad26cb194d0c7d654f9c447857e05dd44b2"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/e4bb21b85440157b588ebbd217995113362962cc","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/e4bb21b85440157b588ebbd217995113362962cc"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/e67b47a47f3bccc9a85aeee6a40cd0188787aa0f","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/e67b47a47f3bccc9a85aeee6a40cd0188787aa0f"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/eb0457503fdb8ac49c662b690a6a4eb139ee4c67","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/eb0457503fdb8ac49c662b690a6a4eb139ee4c67"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18212","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18212"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3639","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3639"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3639","reference_id":"CVE-2025-3639","reference_type":"","scores":[{"value":"2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L"},{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-18T19:51:41Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3639"},{"reference_url":"https://github.com/advisories/GHSA-g4wg-mpfg-x2q6","reference_id":"GHSA-g4wg-mpfg-x2q6","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-g4wg-mpfg-x2q6"}],"fixed_packages":[],"aliases":["CVE-2025-3639","GHSA-g4wg-mpfg-x2q6"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kke1-d8nw-tyhj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88676?format=json","vulnerability_id":"VCID-mmy3-eycu-q7bu","summary":"A Stored cross-site scripting vulnerability in the Liferay Portal  7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43776","reference_id":"","reference_type":"","scores":[{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13922","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43776"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18277","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18277"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43776","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43776"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43776","reference_id":"CVE-2025-43776","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-09T15:04:48Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43776"},{"reference_url":"https://github.com/advisories/GHSA-rcc7-jx7p-hrv4","reference_id":"GHSA-rcc7-jx7p-hrv4","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-rcc7-jx7p-hrv4"}],"fixed_packages":[],"aliases":["CVE-2025-43776","GHSA-rcc7-jx7p-hrv4"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-mmy3-eycu-q7bu"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88869?format=json","vulnerability_id":"VCID-p1dw-dttz-x7ee","summary":"Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Commerce Product's Name text field.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43823","reference_id":"","reference_type":"","scores":[{"value":"0.00031","scoring_system":"epss","scoring_elements":"0.093","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43823"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43823","reference_id":"CVE-2025-43823","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-08T13:40:14Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43823"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43823","reference_id":"CVE-2025-43823","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43823"},{"reference_url":"https://github.com/advisories/GHSA-xx7h-2wf7-hc7p","reference_id":"GHSA-xx7h-2wf7-hc7p","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xx7h-2wf7-hc7p"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33988?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112"}],"aliases":["CVE-2025-43823","GHSA-xx7h-2wf7-hc7p"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-p1dw-dttz-x7ee"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/102607?format=json","vulnerability_id":"VCID-p3dp-ku5j-yke9","summary":"Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId` parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62264","reference_id":"","reference_type":"","scores":[{"value":"0.00031","scoring_system":"epss","scoring_elements":"0.09382","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62264"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62264","reference_id":"CVE-2025-62264","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-31T17:52:20Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62264"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62264","reference_id":"CVE-2025-62264","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62264"},{"reference_url":"https://github.com/advisories/GHSA-2j97-4jmq-c4xf","reference_id":"GHSA-2j97-4jmq-c4xf","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-2j97-4jmq-c4xf"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33988?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112"}],"aliases":["CVE-2025-62264","GHSA-2j97-4jmq-c4xf"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-p3dp-ku5j-yke9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88915?format=json","vulnerability_id":"VCID-ph25-5qgg-zfer","summary":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43734","reference_id":"","reference_type":"","scores":[{"value":"0.0013","scoring_system":"epss","scoring_elements":"0.31998","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43734"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/b4ca1bb0961cc1f230508e072c30815eabce062f","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/b4ca1bb0961cc1f230508e072c30815eabce062f"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18234","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18234"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43734","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43734"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43734","reference_id":"CVE-2025-43734","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-12T19:00:01Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43734"},{"reference_url":"https://github.com/advisories/GHSA-m5c7-5gv3-hcpf","reference_id":"GHSA-m5c7-5gv3-hcpf","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-m5c7-5gv3-hcpf"}],"fixed_packages":[],"aliases":["CVE-2025-43734","GHSA-m5c7-5gv3-hcpf"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ph25-5qgg-zfer"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88435?format=json","vulnerability_id":"VCID-rcmj-djgg-bqf7","summary":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_portletNamespace and _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_namespace parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43746","reference_id":"","reference_type":"","scores":[{"value":"0.00041","scoring_system":"epss","scoring_elements":"0.12693","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43746"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/5ca8331da4503ae336818a747e43817066f27b73","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/5ca8331da4503ae336818a747e43817066f27b73"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/7ac0f245435a18e42291186907ad6dbf0e4e8a43","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/7ac0f245435a18e42291186907ad6dbf0e4e8a43"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/c4c34a13094356160474c06c3a115723d97f75ab","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/c4c34a13094356160474c06c3a115723d97f75ab"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18244","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18244"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43746","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43746"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43746","reference_id":"CVE-2025-43746","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T18:53:24Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43746"},{"reference_url":"https://github.com/advisories/GHSA-mpww-r37c-vxjw","reference_id":"GHSA-mpww-r37c-vxjw","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-mpww-r37c-vxjw"}],"fixed_packages":[],"aliases":["CVE-2025-43746","GHSA-mpww-r37c-vxjw"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rcmj-djgg-bqf7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/144180?format=json","vulnerability_id":"VCID-ser9-x7zq-dqdv","summary":"Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's `URL` text field.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33944","reference_id":"","reference_type":"","scores":[{"value":"0.00304","scoring_system":"epss","scoring_elements":"0.54054","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33944"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33944","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33944"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33944","reference_id":"cve-2023-33944","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-22T15:45:15Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33944"},{"reference_url":"https://github.com/advisories/GHSA-pfwc-4frf-4gf8","reference_id":"GHSA-pfwc-4frf-4gf8","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-pfwc-4frf-4gf8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/381998?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.69","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-4m1t-nd28-43b2"},{"vulnerability":"VCID-55fq-h94e-kuep"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6f8z-s1fz-57b2"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-99sz-6eag-3kff"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d49a-szjx-jub1"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-deaj-uts6-aqb5"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-eb9n-cwf1-fbga"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-evtz-a8xn-e7b6"},{"vulnerability":"VCID-ext6-8u2c-xufv"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hqwn-t5mr-13ab"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-pac3-4jrs-pqdg"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-te96-dz9q-z3cy"},{"vulnerability":"VCID-tkws-gscx-pff6"},{"vulnerability":"VCID-twb2-9ane-tfdw"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-u9gz-jcnn-syby"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"},{"vulnerability":"VCID-zc53-8p5g-2kcv"},{"vulnerability":"VCID-zkm4-bz55-9bb8"},{"vulnerability":"VCID-zn2s-8c79-x7h3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.69"}],"aliases":["CVE-2023-33944","GHSA-pfwc-4frf-4gf8"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ser9-x7zq-dqdv"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88941?format=json","vulnerability_id":"VCID-tkws-gscx-pff6","summary":"Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle text, or (3) Last Name text fields.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43820","reference_id":"","reference_type":"","scores":[{"value":"0.00033","scoring_system":"epss","scoring_elements":"0.10191","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43820"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43820","reference_id":"CVE-2025-43820","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-30T14:46:02Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43820"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43820","reference_id":"CVE-2025-43820","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43820"},{"reference_url":"https://github.com/advisories/GHSA-pf86-4w35-cj89","reference_id":"GHSA-pf86-4w35-cj89","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-pf86-4w35-cj89"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33987?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.111-ga111","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-qxsh-hm7q-5ban"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.111-ga111"},{"url":"http://public2.vulnerablecode.io/api/packages/372003?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-qxsh-hm7q-5ban"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112"}],"aliases":["CVE-2025-43820","GHSA-pf86-4w35-cj89"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-tkws-gscx-pff6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88937?format=json","vulnerability_id":"VCID-twb2-9ane-tfdw","summary":"Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has changed their initial password, which allows remote users to access and edit content via the API.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43799","reference_id":"","reference_type":"","scores":[{"value":"0.00073","scoring_system":"epss","scoring_elements":"0.22258","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43799"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43799","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43799"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43799","reference_id":"CVE-2025-43799","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-15T20:40:56Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43799"},{"reference_url":"https://github.com/advisories/GHSA-43xf-59vr-g4f2","reference_id":"GHSA-43xf-59vr-g4f2","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-43xf-59vr-g4f2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/372003?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-qxsh-hm7q-5ban"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112"}],"aliases":["CVE-2025-43799","GHSA-43xf-59vr-g4f2"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-twb2-9ane-tfdw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88385?format=json","vulnerability_id":"VCID-u5rg-89bb-wbfy","summary":"Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form with a rich text type field.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43830","reference_id":"","reference_type":"","scores":[{"value":"0.00031","scoring_system":"epss","scoring_elements":"0.09382","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43830"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43830","reference_id":"CVE-2025-43830","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-08T13:36:35Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43830"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43830","reference_id":"CVE-2025-43830","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43830"},{"reference_url":"https://github.com/advisories/GHSA-378f-8q54-3fqx","reference_id":"GHSA-378f-8q54-3fqx","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-378f-8q54-3fqx"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33988?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112"}],"aliases":["CVE-2025-43830","GHSA-378f-8q54-3fqx"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-u5rg-89bb-wbfy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/41446?format=json","vulnerability_id":"VCID-u9gz-jcnn-syby","summary":"Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the p_l_back_url parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26272","reference_id":"","reference_type":"","scores":[{"value":"0.03261","scoring_system":"epss","scoring_elements":"0.87434","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26272"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26272","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26272"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26272","reference_id":"CVE-2024-26272","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:15:06Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26272"},{"reference_url":"https://github.com/advisories/GHSA-p63m-vmjr-wg37","reference_id":"GHSA-p63m-vmjr-wg37","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-p63m-vmjr-wg37"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/34841?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108"},{"url":"http://public2.vulnerablecode.io/api/packages/372003?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-qxsh-hm7q-5ban"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112"}],"aliases":["CVE-2024-26272","GHSA-p63m-vmjr-wg37"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-u9gz-jcnn-syby"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88833?format=json","vulnerability_id":"VCID-vcth-rrmy-5qej","summary":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect","references":[{"reference_url":"http://github.com/liferay/liferay-portal/commit/58b365ffe2f088b308cfae207474ade3e143bbf9","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://github.com/liferay/liferay-portal/commit/58b365ffe2f088b308cfae207474ade3e143bbf9"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43760","reference_id":"","reference_type":"","scores":[{"value":"0.00048","scoring_system":"epss","scoring_elements":"0.15365","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43760"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/7a1a7f0359e99be27ca04dab119e867c2263f040","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/7a1a7f0359e99be27ca04dab119e867c2263f040"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/7c742f32f536dadfdbcad68acd20c63363728a25","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/7c742f32f536dadfdbcad68acd20c63363728a25"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/8f5989233fe36261df8e7bb356b1cc833ba4f34e","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/8f5989233fe36261df8e7bb356b1cc833ba4f34e"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9485d39fa2b66cfc075b16fddaafa9fca64a5687","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9485d39fa2b66cfc075b16fddaafa9fca64a5687"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/aa88fd90657cd83d92ed2e6fbcbc28e5cf7e3fca","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/aa88fd90657cd83d92ed2e6fbcbc28e5cf7e3fca"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/c457c6d72685db48ed07562a33c67d7998e88b27","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/c457c6d72685db48ed07562a33c67d7998e88b27"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/ddd3a57cd5d3a8891673491b8b6cb680dff1f3c5","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/ddd3a57cd5d3a8891673491b8b6cb680dff1f3c5"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18156","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18156"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43760","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43760"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43760","reference_id":"CVE-2025-43760","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-22T18:00:22Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43760"},{"reference_url":"https://github.com/advisories/GHSA-fvqv-593q-qp8r","reference_id":"GHSA-fvqv-593q-qp8r","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-fvqv-593q-qp8r"}],"fixed_packages":[],"aliases":["CVE-2025-43760","GHSA-fvqv-593q-qp8r"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vcth-rrmy-5qej"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88922?format=json","vulnerability_id":"VCID-w2a5-j7ew-mbet","summary":"A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 exists in the Asset Publisher configuration UI within the Source.js module. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels which are then inserted into the DOM using innerHTML without proper encoding.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43744","reference_id":"","reference_type":"","scores":[{"value":"0.0005","scoring_system":"epss","scoring_elements":"0.15893","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43744"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/3b36fadfe92437deab4a55029a1a369e046f3829","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/3b36fadfe92437deab4a55029a1a369e046f3829"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/c07a490b3d3759f38c5473cda74e99540bd0235e","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/c07a490b3d3759f38c5473cda74e99540bd0235e"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18271","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18271"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43744","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43744"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43744","reference_id":"CVE-2025-43744","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T14:14:31Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43744"},{"reference_url":"https://github.com/advisories/GHSA-m49p-6cjp-x2h3","reference_id":"GHSA-m49p-6cjp-x2h3","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-m49p-6cjp-x2h3"}],"fixed_packages":[],"aliases":["CVE-2025-43744","GHSA-m49p-6cjp-x2h3"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-w2a5-j7ew-mbet"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/126567?format=json","vulnerability_id":"VCID-w71u-16bg-nke4","summary":"The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 allows an unauthorized user to obtain entry data from forms.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-2565","reference_id":"","reference_type":"","scores":[{"value":"0.00356","scoring_system":"epss","scoring_elements":"0.58268","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-2565"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2565","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2565"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2025-2565","reference_id":"cve-2025-2565","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-20T17:53:33Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2025-2565"},{"reference_url":"https://github.com/advisories/GHSA-9fcg-wrp8-qhr4","reference_id":"GHSA-9fcg-wrp8-qhr4","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-9fcg-wrp8-qhr4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/376715?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.129","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-jpgh-rqqn-x7ge"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.129"}],"aliases":["CVE-2025-2565","GHSA-9fcg-wrp8-qhr4"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-w71u-16bg-nke4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88820?format=json","vulnerability_id":"VCID-whty-vwsm-t7gt","summary":"Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43748","reference_id":"","reference_type":"","scores":[{"value":"0.00036","scoring_system":"epss","scoring_elements":"0.10981","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43748"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-17839","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-17839"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43748","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43748"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43748","reference_id":"CVE-2025-43748","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-08-22T03:55:44Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43748"},{"reference_url":"https://github.com/advisories/GHSA-p9gc-59hf-x48p","reference_id":"GHSA-p9gc-59hf-x48p","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-p9gc-59hf-x48p"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/377797?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120-ga120","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120-ga120"},{"url":"http://public2.vulnerablecode.io/api/packages/787947?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.125","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-jpgh-rqqn-x7ge"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.125"}],"aliases":["CVE-2025-43748","GHSA-p9gc-59hf-x48p"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-whty-vwsm-t7gt"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/107898?format=json","vulnerability_id":"VCID-xftu-6k5q-7ub6","summary":"SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-4655","reference_id":"","reference_type":"","scores":[{"value":"0.00167","scoring_system":"epss","scoring_elements":"0.37659","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-4655"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4655","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4655"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4655","reference_id":"CVE-2025-4655","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-11T18:52:11Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4655"},{"reference_url":"https://github.com/advisories/GHSA-c6g5-g6r7-q4j6","reference_id":"GHSA-c6g5-g6r7-q4j6","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-c6g5-g6r7-q4j6"}],"fixed_packages":[],"aliases":["CVE-2025-4655","GHSA-c6g5-g6r7-q4j6"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xftu-6k5q-7ub6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/88460?format=json","vulnerability_id":"VCID-xvs7-58y1-3ybj","summary":"Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers to determine if an account exist in the application by inspecting the server processing time of the login request.","references":[{"reference_url":"http://github.com/liferay/liferay-portal/commit/8199c568a66d66d6ad7ac450d3c69f6e0e9bd181","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://github.com/liferay/liferay-portal/commit/8199c568a66d66d6ad7ac450d3c69f6e0e9bd181"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43754","reference_id":"","reference_type":"","scores":[{"value":"0.00085","scoring_system":"epss","scoring_elements":"0.24624","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43754"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/06b603671f0e76cd50f56d803a310a3c79944d1d","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/06b603671f0e76cd50f56d803a310a3c79944d1d"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/18a88af5409a5085cb094f5bc55229d5e03a9f29","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/18a88af5409a5085cb094f5bc55229d5e03a9f29"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/33697cf599a2c573ef9571696af55476ecc2ada6","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/33697cf599a2c573ef9571696af55476ecc2ada6"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/367dc7d19aa31eaf881f217ceff9610f1747e2d7","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/367dc7d19aa31eaf881f217ceff9610f1747e2d7"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/38c0a06cebf0d635aa2af9912c068217161fcf1e","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/38c0a06cebf0d635aa2af9912c068217161fcf1e"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/45c3ca76966ddfaf8fe650f28910b0f55536f2b4","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/45c3ca76966ddfaf8fe650f28910b0f55536f2b4"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/53e6dcaa31a7599df8de9d3cef92e59e95a2064e","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/53e6dcaa31a7599df8de9d3cef92e59e95a2064e"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/556450752159503476635c44736721ad797fa431","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/556450752159503476635c44736721ad797fa431"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/5b1bf48b0dc2a062928237ab1ea4a2274c63e652","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/5b1bf48b0dc2a062928237ab1ea4a2274c63e652"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/6629bb176c1f58ca852d599c013bd3e97b3312d3","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/6629bb176c1f58ca852d599c013bd3e97b3312d3"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/6f6f9f0922f6a13e21236915b864e0c1c12e47a9","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/6f6f9f0922f6a13e21236915b864e0c1c12e47a9"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/6fdbb052a6e0cbe8b300138fb75f88df69f58799","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/6fdbb052a6e0cbe8b300138fb75f88df69f58799"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/7118e956516d48792fb9365d1ae1f0ee971a8ac3","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/7118e956516d48792fb9365d1ae1f0ee971a8ac3"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/862ca74aaf98c70823022b6556cdc8a339128f79","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/862ca74aaf98c70823022b6556cdc8a339128f79"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9b4be82e964e9bbab1ce9824a61d9f40b28f38bb","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9b4be82e964e9bbab1ce9824a61d9f40b28f38bb"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9ce8b8dec237f9b9049760904fcefd06a8695832","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9ce8b8dec237f9b9049760904fcefd06a8695832"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/c8041d0f527388305897ac79f98d012bb31b82ac","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/c8041d0f527388305897ac79f98d012bb31b82ac"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/f25bb9583f059f86937649fdacf940928ca3767b","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/f25bb9583f059f86937649fdacf940928ca3767b"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18149","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18149"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43754","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43754"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43754","reference_id":"CVE-2025-43754","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-21T20:01:22Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43754"},{"reference_url":"https://github.com/advisories/GHSA-x7p4-v8mj-6fxx","reference_id":"GHSA-x7p4-v8mj-6fxx","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-x7p4-v8mj-6fxx"}],"fixed_packages":[],"aliases":["CVE-2025-43754","GHSA-x7p4-v8mj-6fxx"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xvs7-58y1-3ybj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/108063?format=json","vulnerability_id":"VCID-y38f-84j9-fygf","summary":"Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-4581","reference_id":"","reference_type":"","scores":[{"value":"0.00195","scoring_system":"epss","scoring_elements":"0.4129","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-4581"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4581","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4581"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4581","reference_id":"CVE-2025-4581","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-11T18:52:25Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4581"},{"reference_url":"https://github.com/advisories/GHSA-6v93-frf9-2rp8","reference_id":"GHSA-6v93-frf9-2rp8","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-6v93-frf9-2rp8"}],"fixed_packages":[],"aliases":["CVE-2025-4581","GHSA-6v93-frf9-2rp8"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-y38f-84j9-fygf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/41350?format=json","vulnerability_id":"VCID-yp7c-xgj7-s3h2","summary":"Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26269","reference_id":"","reference_type":"","scores":[{"value":"0.00147","scoring_system":"epss","scoring_elements":"0.34833","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26269"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26269","reference_id":"cve-2024-26269","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-21T16:16:54Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26269"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26269","reference_id":"CVE-2024-26269","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26269"},{"reference_url":"https://github.com/advisories/GHSA-rwhv-hvj2-qrqm","reference_id":"GHSA-rwhv-hvj2-qrqm","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rwhv-hvj2-qrqm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/29243?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.38","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-39dv-ngxr-vbaj"},{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-493t-ab65-pff3"},{"vulnerability":"VCID-4m1t-nd28-43b2"},{"vulnerability":"VCID-55fq-h94e-kuep"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5sft-4ab1-9kcg"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6f8z-s1fz-57b2"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-99sz-6eag-3kff"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-deaj-uts6-aqb5"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-eb9n-cwf1-fbga"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-evtz-a8xn-e7b6"},{"vulnerability":"VCID-ext6-8u2c-xufv"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-gngs-dm98-eqc2"},{"vulnerability":"VCID-hqwn-t5mr-13ab"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-k56t-ry18-zbg4"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-ser9-x7zq-dqdv"},{"vulnerability":"VCID-tkws-gscx-pff6"},{"vulnerability":"VCID-twb2-9ane-tfdw"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-u9gz-jcnn-syby"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"},{"vulnerability":"VCID-zc53-8p5g-2kcv"},{"vulnerability":"VCID-zkm4-bz55-9bb8"},{"vulnerability":"VCID-zn2s-8c79-x7h3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.38"}],"aliases":["CVE-2024-26269","GHSA-rwhv-hvj2-qrqm"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-yp7c-xgj7-s3h2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/135351?format=json","vulnerability_id":"VCID-zc53-8p5g-2kcv","summary":"Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_roles_admin_web_portlet_RolesAdminPortlet_tabs2 parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-42496","reference_id":"","reference_type":"","scores":[{"value":"0.0044","scoring_system":"epss","scoring_elements":"0.63626","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-42496"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42496","reference_id":"cve-2023-42496","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T16:07:22Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42496"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42496","reference_id":"CVE-2023-42496","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42496"},{"reference_url":"https://github.com/advisories/GHSA-54pv-r62j-9qqc","reference_id":"GHSA-54pv-r62j-9qqc","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-54pv-r62j-9qqc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/29233?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-4m1t-nd28-43b2"},{"vulnerability":"VCID-55fq-h94e-kuep"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6f8z-s1fz-57b2"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-99sz-6eag-3kff"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d49a-szjx-jub1"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-eb9n-cwf1-fbga"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-evtz-a8xn-e7b6"},{"vulnerability":"VCID-ext6-8u2c-xufv"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hqwn-t5mr-13ab"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-k7dn-nb9d-ckdk"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-qxsh-hm7q-5ban"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-tkws-gscx-pff6"},{"vulnerability":"VCID-twb2-9ane-tfdw"},{"vulnerability":"VCID-twyc-srx8-fudj"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-u9gz-jcnn-syby"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"},{"vulnerability":"VCID-zn2s-8c79-x7h3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98"}],"aliases":["CVE-2023-42496","GHSA-54pv-r62j-9qqc"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zc53-8p5g-2kcv"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/138648?format=json","vulnerability_id":"VCID-zkm4-bz55-9bb8","summary":"Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's `Service Class` text field.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-37940","reference_id":"","reference_type":"","scores":[{"value":"0.00175","scoring_system":"epss","scoring_elements":"0.38804","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-37940"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37940","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37940"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940","reference_id":"CVE-2023-37940","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-17T21:41:20Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940"},{"reference_url":"https://github.com/advisories/GHSA-px38-239g-x5mg","reference_id":"GHSA-px38-239g-x5mg","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-px38-239g-x5mg"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/372310?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.88","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-4m1t-nd28-43b2"},{"vulnerability":"VCID-55fq-h94e-kuep"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6f8z-s1fz-57b2"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-99sz-6eag-3kff"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d49a-szjx-jub1"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-deaj-uts6-aqb5"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-eb9n-cwf1-fbga"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-evtz-a8xn-e7b6"},{"vulnerability":"VCID-ext6-8u2c-xufv"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hqwn-t5mr-13ab"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-k7dn-nb9d-ckdk"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-pac3-4jrs-pqdg"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-qxsh-hm7q-5ban"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-tkws-gscx-pff6"},{"vulnerability":"VCID-twb2-9ane-tfdw"},{"vulnerability":"VCID-twyc-srx8-fudj"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-u9gz-jcnn-syby"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"},{"vulnerability":"VCID-zc53-8p5g-2kcv"},{"vulnerability":"VCID-zn2s-8c79-x7h3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.88"}],"aliases":["CVE-2023-37940","GHSA-px38-239g-x5mg"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zkm4-bz55-9bb8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/34499?format=json","vulnerability_id":"VCID-zn2s-8c79-x7h3","summary":"The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173\n does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-8980","reference_id":"","reference_type":"","scores":[{"value":"0.00381","scoring_system":"epss","scoring_elements":"0.59949","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-8980"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8980","reference_id":"","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8980"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980","reference_id":"CVE-2024-8980","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:02:17Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980"},{"reference_url":"https://github.com/advisories/GHSA-chj2-4vg7-hhg3","reference_id":"GHSA-chj2-4vg7-hhg3","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-chj2-4vg7-hhg3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/371922?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.102-GA102","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.102-GA102"},{"url":"http://public2.vulnerablecode.io/api/packages/696549?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3cm9-v7g5-kfcn"},{"vulnerability":"VCID-4m1t-nd28-43b2"},{"vulnerability":"VCID-55fq-h94e-kuep"},{"vulnerability":"VCID-5rce-t9wm-4ycx"},{"vulnerability":"VCID-5ytw-d875-3yfe"},{"vulnerability":"VCID-69x9-5buz-1yht"},{"vulnerability":"VCID-6f8z-s1fz-57b2"},{"vulnerability":"VCID-6jsv-kw7h-9yeu"},{"vulnerability":"VCID-73u9-6qzv-t7f7"},{"vulnerability":"VCID-7bjy-2h8a-ukbe"},{"vulnerability":"VCID-9seq-71yb-tfcf"},{"vulnerability":"VCID-beqe-x5p8-23b9"},{"vulnerability":"VCID-c2hc-pbr7-2yhz"},{"vulnerability":"VCID-d9qm-h8q2-sfda"},{"vulnerability":"VCID-dztj-3hzz-3bcg"},{"vulnerability":"VCID-eb9n-cwf1-fbga"},{"vulnerability":"VCID-ep8t-7k2h-2kdp"},{"vulnerability":"VCID-epds-vwku-cyed"},{"vulnerability":"VCID-evtz-a8xn-e7b6"},{"vulnerability":"VCID-f6z5-3pp9-7qey"},{"vulnerability":"VCID-gfwc-qjpr-6fgf"},{"vulnerability":"VCID-hthn-qn9g-u3dv"},{"vulnerability":"VCID-j2r3-g95d-hued"},{"vulnerability":"VCID-k7dn-nb9d-ckdk"},{"vulnerability":"VCID-kke1-d8nw-tyhj"},{"vulnerability":"VCID-mmy3-eycu-q7bu"},{"vulnerability":"VCID-p1dw-dttz-x7ee"},{"vulnerability":"VCID-p3dp-ku5j-yke9"},{"vulnerability":"VCID-ph25-5qgg-zfer"},{"vulnerability":"VCID-qxsh-hm7q-5ban"},{"vulnerability":"VCID-rcmj-djgg-bqf7"},{"vulnerability":"VCID-tgj6-8vhq-23ae"},{"vulnerability":"VCID-tkws-gscx-pff6"},{"vulnerability":"VCID-twb2-9ane-tfdw"},{"vulnerability":"VCID-u5rg-89bb-wbfy"},{"vulnerability":"VCID-u9gz-jcnn-syby"},{"vulnerability":"VCID-vcth-rrmy-5qej"},{"vulnerability":"VCID-w2a5-j7ew-mbet"},{"vulnerability":"VCID-w71u-16bg-nke4"},{"vulnerability":"VCID-whty-vwsm-t7gt"},{"vulnerability":"VCID-xftu-6k5q-7ub6"},{"vulnerability":"VCID-xvs7-58y1-3ybj"},{"vulnerability":"VCID-y38f-84j9-fygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103"}],"aliases":["CVE-2024-8980","GHSA-chj2-4vg7-hhg3"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zn2s-8c79-x7h3"}],"fixing_vulnerabilities":[],"risk_score":"4.5","resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.37"}