{"url":"http://public2.vulnerablecode.io/api/packages/65211?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.1","type":"maven","namespace":"com.liferay.portal","name":"release.portal.bom","version":"7.4.1","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":null,"latest_non_vulnerable_version":null,"affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47058?format=json","vulnerability_id":"VCID-1fqz-psdf-g7dm","summary":"Liferay Portal and Liferay DXP User Enumeration Vulnerability\nUser enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request's response time.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26268","reference_id":"","reference_type":"","scores":[{"value":"0.00304","scoring_system":"epss","scoring_elements":"0.54034","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00304","scoring_system":"epss","scoring_elements":"0.54027","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26268"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/46db55ec21103fa39542e2cba080c4f98e3c5f93","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/46db55ec21103fa39542e2cba080c4f98e3c5f93"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/d8d0ae0178a2d902b541c80a230a2c7a5ab246e8","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/d8d0ae0178a2d902b541c80a230a2c7a5ab246e8"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26268","reference_id":"CVE-2024-26268","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-20T16:17:11Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26268"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26268","reference_id":"CVE-2024-26268","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26268"},{"reference_url":"https://github.com/advisories/GHSA-qm43-g2xj-hvg5","reference_id":"GHSA-qm43-g2xj-hvg5","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qm43-g2xj-hvg5"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69041?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27-ga27","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27-ga27"},{"url":"http://public2.vulnerablecode.io/api/packages/504697?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.28","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dvp1-5vf5-qfg9"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ej5y-geq1-pkfn"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.28"}],"aliases":["CVE-2024-26268","GHSA-qm43-g2xj-hvg5"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1fqz-psdf-g7dm"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/56049?format=json","vulnerability_id":"VCID-1jgz-k7zp-uydp","summary":"Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions\nThe workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38002","reference_id":"","reference_type":"","scores":[{"value":"0.04275","scoring_system":"epss","scoring_elements":"0.89044","published_at":"2026-06-06T12:55:00Z"},{"value":"0.04275","scoring_system":"epss","scoring_elements":"0.89043","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38002"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-38002","reference_id":"CVE-2024-38002","reference_type":"","scores":[{"value":"9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:21:03Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-38002"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38002","reference_id":"CVE-2024-38002","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38002"},{"reference_url":"https://github.com/advisories/GHSA-3mfq-fp2f-vwqh","reference_id":"GHSA-3mfq-fp2f-vwqh","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-3mfq-fp2f-vwqh"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/70671?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112"}],"aliases":["CVE-2024-38002","GHSA-3mfq-fp2f-vwqh"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1jgz-k7zp-uydp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47059?format=json","vulnerability_id":"VCID-266t-4gfq-duh4","summary":"Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel\nInformation disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25150","reference_id":"","reference_type":"","scores":[{"value":"0.00172","scoring_system":"epss","scoring_elements":"0.3847","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00172","scoring_system":"epss","scoring_elements":"0.38467","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25150"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/12844a327061ad55e560f5ab7056381e9cc05d86","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/12844a327061ad55e560f5ab7056381e9cc05d86"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/8eba0b84a0967ad785d96cb09f41f3fac998dcfc","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/8eba0b84a0967ad785d96cb09f41f3fac998dcfc"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9d7676866a77c910a7cf689e33c621666bff9a04","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9d7676866a77c910a7cf689e33c621666bff9a04"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/c5fa9c50514d2be0191cb076b8744c7a871f23dc","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/c5fa9c50514d2be0191cb076b8744c7a871f23dc"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/eee01ec6cce3cca99c9e12fba846db1fc64d610d","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/eee01ec6cce3cca99c9e12fba846db1fc64d610d"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/f9d6c9b9551956c6f07d4ae8998f53392e3389c0","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/f9d6c9b9551956c6f07d4ae8998f53392e3389c0"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25150","reference_id":"CVE-2024-25150","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T14:56:08Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25150"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25150","reference_id":"CVE-2024-25150","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25150"},{"reference_url":"https://github.com/advisories/GHSA-4585-28v2-8h46","reference_id":"GHSA-4585-28v2-8h46","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-4585-28v2-8h46"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69044?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4-ga4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4-ga4"},{"url":"http://public2.vulnerablecode.io/api/packages/69097?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5"}],"aliases":["CVE-2024-25150","GHSA-4585-28v2-8h46"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-266t-4gfq-duh4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/58125?format=json","vulnerability_id":"VCID-27a1-teqk-cbe2","summary":"Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting\nA stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43776","reference_id":"","reference_type":"","scores":[{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13928","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13932","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43776"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18277","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18277"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43776","reference_id":"CVE-2025-43776","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-09T15:04:48Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43776"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43776","reference_id":"CVE-2025-43776","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43776"},{"reference_url":"https://github.com/advisories/GHSA-rcc7-jx7p-hrv4","reference_id":"GHSA-rcc7-jx7p-hrv4","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-rcc7-jx7p-hrv4"}],"fixed_packages":[],"aliases":["CVE-2025-43776","GHSA-rcc7-jx7p-hrv4"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-27a1-teqk-cbe2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/48158?format=json","vulnerability_id":"VCID-292m-hgvs-93ey","summary":"Liferay Portal Vulnerable to DoS via Crafted Headless API Request\nLiferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing a request that returns a large number of objects.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62260","reference_id":"","reference_type":"","scores":[{"value":"0.00169","scoring_system":"epss","scoring_elements":"0.37912","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00169","scoring_system":"epss","scoring_elements":"0.37909","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62260"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/5f5c73913b0e7287f7de0b4e19987cc57844b691","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/5f5c73913b0e7287f7de0b4e19987cc57844b691"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-17800","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-17800"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62260","reference_id":"CVE-2025-62260","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-28T15:01:15Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62260"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62260","reference_id":"CVE-2025-62260","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62260"},{"reference_url":"https://github.com/advisories/GHSA-vgqx-447m-wvcj","reference_id":"GHSA-vgqx-447m-wvcj","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vgqx-447m-wvcj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69070?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-3hm3-htje-akgd"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ej5y-geq1-pkfn"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mbd8-z3ry-cqap"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-rs2y-3c75-uycm"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-su57-hncy-5qg4"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100"}],"aliases":["CVE-2025-62260","GHSA-vgqx-447m-wvcj"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-292m-hgvs-93ey"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47042?format=json","vulnerability_id":"VCID-298n-mh47-3ygq","summary":"Liferay Portal has an XXE vulnerability in Java2WsddTask._format\nXXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25606","reference_id":"","reference_type":"","scores":[{"value":"0.00141","scoring_system":"epss","scoring_elements":"0.33983","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00141","scoring_system":"epss","scoring_elements":"0.33968","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25606"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25606","reference_id":"CVE-2024-25606","reference_type":"","scores":[{"value":"8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"},{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T13:32:40Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25606"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25606","reference_id":"CVE-2024-25606","reference_type":"","scores":[{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25606"},{"reference_url":"https://github.com/advisories/GHSA-869h-qhfx-w939","reference_id":"GHSA-869h-qhfx-w939","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-869h-qhfx-w939"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69058?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.8"}],"aliases":["CVE-2024-25606","GHSA-869h-qhfx-w939"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-298n-mh47-3ygq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/48313?format=json","vulnerability_id":"VCID-2bcr-bxek-skfq","summary":"Liferay Portal vulnerable to password enumeration\nPassword enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62257","reference_id":"","reference_type":"","scores":[{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03992","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03995","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62257"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/45cffd5030ab78e8b005d9cfd6284311da978c68","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/45cffd5030ab78e8b005d9cfd6284311da978c68"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/924a0a47007665693fe2d29623cb48a426a80266","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/924a0a47007665693fe2d29623cb48a426a80266"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/d21627ac07561c5063f611be631e63ff502ec8e7","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/d21627ac07561c5063f611be631e63ff502ec8e7"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-17692","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-17692"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257","reference_id":"CVE-2025-62257","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-30T14:08:10Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62257","reference_id":"CVE-2025-62257","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62257"},{"reference_url":"https://github.com/advisories/GHSA-8hw3-ghwv-crfh","reference_id":"GHSA-8hw3-ghwv-crfh","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8hw3-ghwv-crfh"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/71302?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120"}],"aliases":["CVE-2025-62257","GHSA-8hw3-ghwv-crfh"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2bcr-bxek-skfq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57950?format=json","vulnerability_id":"VCID-2dra-x6f5-xybz","summary":"Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect\nA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect","references":[{"reference_url":"http://github.com/liferay/liferay-portal/commit/58b365ffe2f088b308cfae207474ade3e143bbf9","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://github.com/liferay/liferay-portal/commit/58b365ffe2f088b308cfae207474ade3e143bbf9"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43760","reference_id":"","reference_type":"","scores":[{"value":"0.00048","scoring_system":"epss","scoring_elements":"0.15367","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00048","scoring_system":"epss","scoring_elements":"0.15376","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43760"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/7a1a7f0359e99be27ca04dab119e867c2263f040","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/7a1a7f0359e99be27ca04dab119e867c2263f040"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/7c742f32f536dadfdbcad68acd20c63363728a25","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/7c742f32f536dadfdbcad68acd20c63363728a25"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/8f5989233fe36261df8e7bb356b1cc833ba4f34e","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/8f5989233fe36261df8e7bb356b1cc833ba4f34e"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9485d39fa2b66cfc075b16fddaafa9fca64a5687","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9485d39fa2b66cfc075b16fddaafa9fca64a5687"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/aa88fd90657cd83d92ed2e6fbcbc28e5cf7e3fca","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/aa88fd90657cd83d92ed2e6fbcbc28e5cf7e3fca"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/c457c6d72685db48ed07562a33c67d7998e88b27","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/c457c6d72685db48ed07562a33c67d7998e88b27"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/ddd3a57cd5d3a8891673491b8b6cb680dff1f3c5","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/ddd3a57cd5d3a8891673491b8b6cb680dff1f3c5"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18156","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18156"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43760","reference_id":"CVE-2025-43760","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-22T18:00:22Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43760"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43760","reference_id":"CVE-2025-43760","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43760"},{"reference_url":"https://github.com/advisories/GHSA-fvqv-593q-qp8r","reference_id":"GHSA-fvqv-593q-qp8r","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-fvqv-593q-qp8r"}],"fixed_packages":[],"aliases":["CVE-2025-43760","GHSA-fvqv-593q-qp8r"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2dra-x6f5-xybz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/108928?format=json","vulnerability_id":"VCID-2fn6-apud-qbh4","summary":"Liferay Portal Insecure Default Configuration in auth.login.prompt.enabled\nAn insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-41414","reference_id":"","reference_type":"","scores":[{"value":"0.00206","scoring_system":"epss","scoring_elements":"0.42656","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00206","scoring_system":"epss","scoring_elements":"0.42741","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00206","scoring_system":"epss","scoring_elements":"0.4273","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-41414"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/659c4422bd32b1db1a01a7f4a42b7702d512ffa2","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/659c4422bd32b1db1a01a7f4a42b7702d512ffa2"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-01-insecure-defaults-auth-login-prompt-enabled?p_r_p_assetEntryId=121612026&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612026%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-01-insecure-defaults-auth-login-prompt-enabled?p_r_p_assetEntryId=121612026&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612026%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41414","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41414"},{"reference_url":"https://github.com/advisories/GHSA-9427-7f65-88c8","reference_id":"GHSA-9427-7f65-88c8","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-9427-7f65-88c8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61432?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-ga3","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-ga3"},{"url":"http://public2.vulnerablecode.io/api/packages/609681?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-266t-4gfq-duh4"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-37ph-hjq9-bufq"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-afe9-yqy2-8bdb"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-bbzr-zx1c-m3ck"},{"vulnerability":"VCID-bg89-tyhn-sfc3"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-pczz-39pz-37bb"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-xuaz-p5q4-8beh"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-y8xm-g4zt-b7b5"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"},{"vulnerability":"VCID-zmf4-acz8-s3a2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1"}],"aliases":["CVE-2022-41414","GHSA-9427-7f65-88c8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2fn6-apud-qbh4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57910?format=json","vulnerability_id":"VCID-2mtb-mdha-qufv","summary":"Liferay Portal Vulnerable to Cross-Site Request Forgery\nInsufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43748","reference_id":"","reference_type":"","scores":[{"value":"0.00033","scoring_system":"epss","scoring_elements":"0.10059","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00036","scoring_system":"epss","scoring_elements":"0.11","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43748"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-17839","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-17839"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43748","reference_id":"CVE-2025-43748","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-08-22T03:55:44Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43748"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43748","reference_id":"CVE-2025-43748","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43748"},{"reference_url":"https://github.com/advisories/GHSA-p9gc-59hf-x48p","reference_id":"GHSA-p9gc-59hf-x48p","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-p9gc-59hf-x48p"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/86133?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120-ga120","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-u1pr-9cpx-q3hg"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120-ga120"},{"url":"http://public2.vulnerablecode.io/api/packages/808919?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.125","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-u1pr-9cpx-q3hg"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.125"}],"aliases":["CVE-2025-43748","GHSA-p9gc-59hf-x48p"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2mtb-mdha-qufv"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/110301?format=json","vulnerability_id":"VCID-37ph-hjq9-bufq","summary":"Inefficient Regular Expression Complexity in Liferay Portal\nReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume an excessive amount of server resources via a crafted payload injected into the 'name' field of a layout prototype.","references":[{"reference_url":"http://liferay.com","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-30T14:49:41Z/"}],"url":"http://liferay.com"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42124","reference_id":"","reference_type":"","scores":[{"value":"0.01185","scoring_system":"epss","scoring_elements":"0.79158","published_at":"2026-06-06T12:55:00Z"},{"value":"0.01185","scoring_system":"epss","scoring_elements":"0.79126","published_at":"2026-06-04T12:55:00Z"},{"value":"0.01185","scoring_system":"epss","scoring_elements":"0.79153","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42124"},{"reference_url":"https://issues.liferay.com/browse/LPE-17435","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-30T14:49:41Z/"}],"url":"https://issues.liferay.com/browse/LPE-17435"},{"reference_url":"https://issues.liferay.com/browse/LPE-17535","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-30T14:49:41Z/"}],"url":"https://issues.liferay.com/browse/LPE-17535"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42124","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42124"},{"reference_url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42124","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-30T14:49:41Z/"}],"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42124"},{"reference_url":"https://github.com/advisories/GHSA-vjj4-qwcm-552h","reference_id":"GHSA-vjj4-qwcm-552h","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vjj4-qwcm-552h"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69097?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5"}],"aliases":["CVE-2022-42124","GHSA-vjj4-qwcm-552h"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-37ph-hjq9-bufq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47045?format=json","vulnerability_id":"VCID-38vz-usgx-g7dv","summary":"Liferay Portal defaults to a low work factor for the default password hashing algorithm\nThe default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25607","reference_id":"","reference_type":"","scores":[{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27364","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27414","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25607"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25607","reference_id":"CVE-2024-25607","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-20T13:27:04Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25607"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25607","reference_id":"CVE-2024-25607","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25607"},{"reference_url":"https://github.com/advisories/GHSA-43h9-p3j4-39hm","reference_id":"GHSA-43h9-p3j4-39hm","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-43h9-p3j4-39hm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69017?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14"}],"aliases":["CVE-2024-25607","GHSA-43h9-p3j4-39hm"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-38vz-usgx-g7dv"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57908?format=json","vulnerability_id":"VCID-434b-p73k-5fam","summary":"Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping\nA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_portletNamespace and _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_namespace parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43746","reference_id":"","reference_type":"","scores":[{"value":"0.00041","scoring_system":"epss","scoring_elements":"0.1269","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00041","scoring_system":"epss","scoring_elements":"0.12686","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43746"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/5ca8331da4503ae336818a747e43817066f27b73","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/5ca8331da4503ae336818a747e43817066f27b73"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/7ac0f245435a18e42291186907ad6dbf0e4e8a43","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/7ac0f245435a18e42291186907ad6dbf0e4e8a43"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/c4c34a13094356160474c06c3a115723d97f75ab","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/c4c34a13094356160474c06c3a115723d97f75ab"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18244","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18244"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43746","reference_id":"CVE-2025-43746","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T18:53:24Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43746"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43746","reference_id":"CVE-2025-43746","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43746"},{"reference_url":"https://github.com/advisories/GHSA-mpww-r37c-vxjw","reference_id":"GHSA-mpww-r37c-vxjw","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-mpww-r37c-vxjw"}],"fixed_packages":[],"aliases":["CVE-2025-43746","GHSA-mpww-r37c-vxjw"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-434b-p73k-5fam"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/45253?format=json","vulnerability_id":"VCID-4611-azkf-sffv","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a facet label.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33939","reference_id":"","reference_type":"","scores":[{"value":"0.00296","scoring_system":"epss","scoring_elements":"0.53255","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00296","scoring_system":"epss","scoring_elements":"0.53263","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33939"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33939","reference_id":"CVE-2023-33939","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-22T15:45:50Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33939"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33939","reference_id":"CVE-2023-33939","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33939"},{"reference_url":"https://github.com/advisories/GHSA-53mw-69qx-q4fc","reference_id":"GHSA-53mw-69qx-q4fc","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-53mw-69qx-q4fc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65209?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13"}],"aliases":["CVE-2023-33939","GHSA-53mw-69qx-q4fc"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4611-azkf-sffv"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57900?format=json","vulnerability_id":"VCID-4kym-jhtn-cfa3","summary":"Liferay Portal Vulnerable to Cross-Site Scripting via assetTagNames Parameter\nA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScrip in the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_assetTagNames parameter","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43741","reference_id":"","reference_type":"","scores":[{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.14024","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43741"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/264f4f91aa4f8373c5a9cc44420edf1689384cbb","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/264f4f91aa4f8373c5a9cc44420edf1689384cbb"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18193","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18193"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43741","reference_id":"CVE-2025-43741","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T15:16:53Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43741"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43741","reference_id":"CVE-2025-43741","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43741"},{"reference_url":"https://github.com/advisories/GHSA-j6p8-g3rj-ghpm","reference_id":"GHSA-j6p8-g3rj-ghpm","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-j6p8-g3rj-ghpm"}],"fixed_packages":[],"aliases":["CVE-2025-43741","GHSA-j6p8-g3rj-ghpm"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4kym-jhtn-cfa3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47091?format=json","vulnerability_id":"VCID-4mcy-yw2p-v7bd","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nStored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the name text field of a geolocation custom field.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25601","reference_id":"","reference_type":"","scores":[{"value":"0.00152","scoring_system":"epss","scoring_elements":"0.35713","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00152","scoring_system":"epss","scoring_elements":"0.35702","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25601"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25601","reference_id":"CVE-2024-25601","reference_type":"","scores":[{"value":"9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T14:15:10Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25601"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25601","reference_id":"CVE-2024-25601","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25601"},{"reference_url":"https://github.com/advisories/GHSA-cr36-3vqf-x5w5","reference_id":"GHSA-cr36-3vqf-x5w5","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-cr36-3vqf-x5w5"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/609681?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-266t-4gfq-duh4"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-37ph-hjq9-bufq"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-afe9-yqy2-8bdb"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-bbzr-zx1c-m3ck"},{"vulnerability":"VCID-bg89-tyhn-sfc3"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-pczz-39pz-37bb"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-xuaz-p5q4-8beh"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-y8xm-g4zt-b7b5"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"},{"vulnerability":"VCID-zmf4-acz8-s3a2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1"}],"aliases":["CVE-2024-25601","GHSA-cr36-3vqf-x5w5"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4mcy-yw2p-v7bd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57922?format=json","vulnerability_id":"VCID-4xqq-69ab-1qew","summary":"Liferay Portal Username Enumeration Vulnerability\nUsername enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers to determine if an account exist in the application by inspecting the server processing time of the login request.","references":[{"reference_url":"http://github.com/liferay/liferay-portal/commit/8199c568a66d66d6ad7ac450d3c69f6e0e9bd181","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://github.com/liferay/liferay-portal/commit/8199c568a66d66d6ad7ac450d3c69f6e0e9bd181"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43754","reference_id":"","reference_type":"","scores":[{"value":"0.00078","scoring_system":"epss","scoring_elements":"0.23393","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00078","scoring_system":"epss","scoring_elements":"0.23405","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43754"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/06b603671f0e76cd50f56d803a310a3c79944d1d","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/06b603671f0e76cd50f56d803a310a3c79944d1d"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/18a88af5409a5085cb094f5bc55229d5e03a9f29","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/18a88af5409a5085cb094f5bc55229d5e03a9f29"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/33697cf599a2c573ef9571696af55476ecc2ada6","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/33697cf599a2c573ef9571696af55476ecc2ada6"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/367dc7d19aa31eaf881f217ceff9610f1747e2d7","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/367dc7d19aa31eaf881f217ceff9610f1747e2d7"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/38c0a06cebf0d635aa2af9912c068217161fcf1e","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/38c0a06cebf0d635aa2af9912c068217161fcf1e"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/45c3ca76966ddfaf8fe650f28910b0f55536f2b4","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/45c3ca76966ddfaf8fe650f28910b0f55536f2b4"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/53e6dcaa31a7599df8de9d3cef92e59e95a2064e","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/53e6dcaa31a7599df8de9d3cef92e59e95a2064e"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/556450752159503476635c44736721ad797fa431","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/556450752159503476635c44736721ad797fa431"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/5b1bf48b0dc2a062928237ab1ea4a2274c63e652","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/5b1bf48b0dc2a062928237ab1ea4a2274c63e652"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/6629bb176c1f58ca852d599c013bd3e97b3312d3","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/6629bb176c1f58ca852d599c013bd3e97b3312d3"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/6f6f9f0922f6a13e21236915b864e0c1c12e47a9","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/6f6f9f0922f6a13e21236915b864e0c1c12e47a9"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/6fdbb052a6e0cbe8b300138fb75f88df69f58799","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/6fdbb052a6e0cbe8b300138fb75f88df69f58799"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/7118e956516d48792fb9365d1ae1f0ee971a8ac3","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/7118e956516d48792fb9365d1ae1f0ee971a8ac3"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/862ca74aaf98c70823022b6556cdc8a339128f79","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/862ca74aaf98c70823022b6556cdc8a339128f79"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9b4be82e964e9bbab1ce9824a61d9f40b28f38bb","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9b4be82e964e9bbab1ce9824a61d9f40b28f38bb"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9ce8b8dec237f9b9049760904fcefd06a8695832","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9ce8b8dec237f9b9049760904fcefd06a8695832"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/c8041d0f527388305897ac79f98d012bb31b82ac","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/c8041d0f527388305897ac79f98d012bb31b82ac"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/f25bb9583f059f86937649fdacf940928ca3767b","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/f25bb9583f059f86937649fdacf940928ca3767b"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18149","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18149"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43754","reference_id":"CVE-2025-43754","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-21T20:01:22Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43754"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43754","reference_id":"CVE-2025-43754","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43754"},{"reference_url":"https://github.com/advisories/GHSA-x7p4-v8mj-6fxx","reference_id":"GHSA-x7p4-v8mj-6fxx","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-x7p4-v8mj-6fxx"}],"fixed_packages":[],"aliases":["CVE-2025-43754","GHSA-x7p4-v8mj-6fxx"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4xqq-69ab-1qew"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47956?format=json","vulnerability_id":"VCID-5732-ffyz-9fh5","summary":"Liferay Profile Widget does not prevent vCard extension spoofing\nThe Profile Widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file is downloaded.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43824","reference_id":"","reference_type":"","scores":[{"value":"0.00033","scoring_system":"epss","scoring_elements":"0.10191","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00033","scoring_system":"epss","scoring_elements":"0.10172","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43824"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43824","reference_id":"CVE-2025-43824","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-07T15:52:30Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43824"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43824","reference_id":"CVE-2025-43824","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43824"},{"reference_url":"https://github.com/advisories/GHSA-pfxj-gvqg-mj44","reference_id":"GHSA-pfxj-gvqg-mj44","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-pfxj-gvqg-mj44"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/70671?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112"}],"aliases":["CVE-2025-43824","GHSA-pfxj-gvqg-mj44"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5732-ffyz-9fh5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/56046?format=json","vulnerability_id":"VCID-5bex-xcub-3qhr","summary":"Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor\nCross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the `_com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect` parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26273","reference_id":"","reference_type":"","scores":[{"value":"0.02006","scoring_system":"epss","scoring_elements":"0.84028","published_at":"2026-06-05T12:55:00Z"},{"value":"0.02193","scoring_system":"epss","scoring_elements":"0.84731","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26273"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26273","reference_id":"CVE-2024-26273","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:18:21Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26273"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26273","reference_id":"CVE-2024-26273","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26273"},{"reference_url":"https://github.com/advisories/GHSA-hmrx-6pr5-hpwj","reference_id":"GHSA-hmrx-6pr5-hpwj","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-hmrx-6pr5-hpwj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/83027?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.104","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-3hm3-htje-akgd"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-rs2y-3c75-uycm"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-su57-hncy-5qg4"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.104"}],"aliases":["CVE-2024-26273","GHSA-hmrx-6pr5-hpwj"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5bex-xcub-3qhr"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47575?format=json","vulnerability_id":"VCID-68yp-31d3-zbay","summary":"Liferay Portal Uses Default Password\nLiferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has changed their initial password, which allows remote users to access and edit content via the API.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43799","reference_id":"","reference_type":"","scores":[{"value":"0.00073","scoring_system":"epss","scoring_elements":"0.22327","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00073","scoring_system":"epss","scoring_elements":"0.22313","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43799"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43799","reference_id":"CVE-2025-43799","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-15T20:40:56Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43799"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43799","reference_id":"CVE-2025-43799","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43799"},{"reference_url":"https://github.com/advisories/GHSA-43xf-59vr-g4f2","reference_id":"GHSA-43xf-59vr-g4f2","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-43xf-59vr-g4f2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69927?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-su57-hncy-5qg4"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112"}],"aliases":["CVE-2025-43799","GHSA-43xf-59vr-g4f2"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-68yp-31d3-zbay"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/48159?format=json","vulnerability_id":"VCID-6yrk-8tj5-juhp","summary":"Liferay Portal Vulnerable to CSRF in Headless APIs\nCSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62258","reference_id":"","reference_type":"","scores":[{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06824","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.0682","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62258"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"7.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62258","reference_id":"CVE-2025-62258","reference_type":"","scores":[{"value":"7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"7.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-28T14:59:44Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62258"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62258","reference_id":"CVE-2025-62258","reference_type":"","scores":[{"value":"7.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62258"},{"reference_url":"https://github.com/advisories/GHSA-gh4w-8qgq-8w9r","reference_id":"GHSA-gh4w-8qgq-8w9r","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gh4w-8qgq-8w9r"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/71164?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108"},{"url":"http://public2.vulnerablecode.io/api/packages/69927?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-su57-hncy-5qg4"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112"}],"aliases":["CVE-2025-62258","GHSA-gh4w-8qgq-8w9r"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6yrk-8tj5-juhp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/110163?format=json","vulnerability_id":"VCID-7tas-6nn4-9fhu","summary":"Missing permissions check in Liferay Portal\nThe Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.","references":[{"reference_url":"http://liferay.com","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:31:00Z/"}],"url":"http://liferay.com"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42126","reference_id":"","reference_type":"","scores":[{"value":"0.00144","scoring_system":"epss","scoring_elements":"0.34559","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00144","scoring_system":"epss","scoring_elements":"0.34445","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00144","scoring_system":"epss","scoring_elements":"0.34543","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42126"},{"reference_url":"https://issues.liferay.com/browse/LPE-17593","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:31:00Z/"}],"url":"https://issues.liferay.com/browse/LPE-17593"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42126","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42126"},{"reference_url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:31:00Z/"}],"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126"},{"reference_url":"https://github.com/advisories/GHSA-642h-mx8q-47p2","reference_id":"GHSA-642h-mx8q-47p2","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-642h-mx8q-47p2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/609696?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.29","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dvp1-5vf5-qfg9"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ej5y-geq1-pkfn"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.29"},{"url":"http://public2.vulnerablecode.io/api/packages/65218?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-3hm3-htje-akgd"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dvp1-5vf5-qfg9"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ej5y-geq1-pkfn"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mbd8-z3ry-cqap"},{"vulnerability":"VCID-mf9a-eusx-f3gb"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-uun9-ctyg-k3d9"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-xn3y-rrkc-7bcz"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48"}],"aliases":["CVE-2022-42126","GHSA-642h-mx8q-47p2"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-7tas-6nn4-9fhu"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47054?format=json","vulnerability_id":"VCID-8jv6-163j-a7b2","summary":"Liferay Portal and Liferay DXP Does Not Properly Restrict Membership to Child Site Based on Parent Site Options\nLiferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the \"Limit membership to members of the parent site\" option is enabled, which allows remote authenticated users to add users who are not a member of the parent site to a child site. The added user may obtain permission to perform unauthorized actions in the child site.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25149","reference_id":"","reference_type":"","scores":[{"value":"0.00259","scoring_system":"epss","scoring_elements":"0.49533","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00259","scoring_system":"epss","scoring_elements":"0.49523","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25149"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/dfd287acb325e2cddced3910e3baba1d258509de","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/dfd287acb325e2cddced3910e3baba1d258509de"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25149","reference_id":"CVE-2024-25149","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-22T17:46:50Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25149"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25149","reference_id":"CVE-2024-25149","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25149"},{"reference_url":"https://github.com/advisories/GHSA-qpgh-6v9w-vfv6","reference_id":"GHSA-qpgh-6v9w-vfv6","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qpgh-6v9w-vfv6"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61432?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-ga3","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-ga3"},{"url":"http://public2.vulnerablecode.io/api/packages/609681?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-266t-4gfq-duh4"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-37ph-hjq9-bufq"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-afe9-yqy2-8bdb"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-bbzr-zx1c-m3ck"},{"vulnerability":"VCID-bg89-tyhn-sfc3"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-pczz-39pz-37bb"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-xuaz-p5q4-8beh"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-y8xm-g4zt-b7b5"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"},{"vulnerability":"VCID-zmf4-acz8-s3a2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1"}],"aliases":["CVE-2024-25149","GHSA-qpgh-6v9w-vfv6"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8jv6-163j-a7b2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57872?format=json","vulnerability_id":"VCID-8xx2-vtnr-dubu","summary":"Liferay Portal Login Bypass Vulnerability\nLiferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-3639","reference_id":"","reference_type":"","scores":[{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13777","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13774","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-3639"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/383a4001cfdf533eb077ed6f03bc5f8fed27cf05","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/383a4001cfdf533eb077ed6f03bc5f8fed27cf05"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/774c89c853d4b9d9abb61d6e079dab21f582cc78","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/774c89c853d4b9d9abb61d6e079dab21f582cc78"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/7a70daf60416d536a45fe137d54e1054e9394fa7","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/7a70daf60416d536a45fe137d54e1054e9394fa7"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/a0265c3847af01a37d2a9ad1560e4408f2856518","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/a0265c3847af01a37d2a9ad1560e4408f2856518"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/a5081fefaffdd86a9306320c46e91f98973c39cb","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/a5081fefaffdd86a9306320c46e91f98973c39cb"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/d2806ad26cb194d0c7d654f9c447857e05dd44b2","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/d2806ad26cb194d0c7d654f9c447857e05dd44b2"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/e4bb21b85440157b588ebbd217995113362962cc","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/e4bb21b85440157b588ebbd217995113362962cc"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/e67b47a47f3bccc9a85aeee6a40cd0188787aa0f","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/e67b47a47f3bccc9a85aeee6a40cd0188787aa0f"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/eb0457503fdb8ac49c662b690a6a4eb139ee4c67","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/eb0457503fdb8ac49c662b690a6a4eb139ee4c67"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18212","reference_id":"","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18212"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3639","reference_id":"CVE-2025-3639","reference_type":"","scores":[{"value":"2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L"},{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-18T19:51:41Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3639"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3639","reference_id":"CVE-2025-3639","reference_type":"","scores":[{"value":"2.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3639"},{"reference_url":"https://github.com/advisories/GHSA-g4wg-mpfg-x2q6","reference_id":"GHSA-g4wg-mpfg-x2q6","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-g4wg-mpfg-x2q6"}],"fixed_packages":[],"aliases":["CVE-2025-3639","GHSA-g4wg-mpfg-x2q6"],"risk_score":1.4,"exploitability":"0.5","weighted_severity":"2.7","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8xx2-vtnr-dubu"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47047?format=json","vulnerability_id":"VCID-9471-umbz-pucy","summary":"Liferay Portal and Liferay DXP Allows Templates to be Viewed via the UI or API\nThe Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25605","reference_id":"","reference_type":"","scores":[{"value":"0.00186","scoring_system":"epss","scoring_elements":"0.40266","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00186","scoring_system":"epss","scoring_elements":"0.40263","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25605"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/45ffb97de7ac475335215f2b6e86ebe1e7283ab4","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/45ffb97de7ac475335215f2b6e86ebe1e7283ab4"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/5eb426ecc49e036ad566e829b8a2132104f7130e","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/5eb426ecc49e036ad566e829b8a2132104f7130e"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25605","reference_id":"CVE-2024-25605","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-20T16:21:08Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25605"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25605","reference_id":"CVE-2024-25605","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25605"},{"reference_url":"https://github.com/advisories/GHSA-mf8h-grfg-j9j3","reference_id":"GHSA-mf8h-grfg-j9j3","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mf8h-grfg-j9j3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69030?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5-ga5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5-ga5"},{"url":"http://public2.vulnerablecode.io/api/packages/609682?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6"}],"aliases":["CVE-2024-25605","GHSA-mf8h-grfg-j9j3"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9471-umbz-pucy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47064?format=json","vulnerability_id":"VCID-9yw4-52sc-rbbz","summary":"Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Two Forward Slashes\nHtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect. This vulnerability is the result of an incomplete fix in CVE-2022-28977.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25609","reference_id":"","reference_type":"","scores":[{"value":"0.00261","scoring_system":"epss","scoring_elements":"0.49723","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00261","scoring_system":"epss","scoring_elements":"0.49713","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25609"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/3c5ee2054b44e4354cd2e53782914157ef2b5362","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/3c5ee2054b44e4354cd2e53782914157ef2b5362"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/5c9655c941b18d8948a0c38b2bc84f4a1f83543a","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/5c9655c941b18d8948a0c38b2bc84f4a1f83543a"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/66f3ae610c24f10a6950e75e0ca4c981935244ed","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/66f3ae610c24f10a6950e75e0ca4c981935244ed"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/702a1e35896681f04ec3c7c8075aa87d5e16a18d","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/702a1e35896681f04ec3c7c8075aa87d5e16a18d"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/7aca15e7195a03243d5461fcf09cde0fa7de81f0","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/7aca15e7195a03243d5461fcf09cde0fa7de81f0"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/dca931af71a3d9fbd896a25b92396df8458d2886","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/dca931af71a3d9fbd896a25b92396df8458d2886"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/f015ad20bd9ee1661ccff5fb48e03dd3a1ebf003","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/f015ad20bd9ee1661ccff5fb48e03dd3a1ebf003"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25609","reference_id":"CVE-2024-25609","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-23T19:18:48Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25609"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25609","reference_id":"CVE-2024-25609","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25609"},{"reference_url":"https://github.com/advisories/GHSA-3qq5-wcrx-4h8r","reference_id":"GHSA-3qq5-wcrx-4h8r","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3qq5-wcrx-4h8r"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69055?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13-ga13","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13-ga13"},{"url":"http://public2.vulnerablecode.io/api/packages/69017?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14"}],"aliases":["CVE-2024-25609","GHSA-3qq5-wcrx-4h8r"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9yw4-52sc-rbbz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/46965?format=json","vulnerability_id":"VCID-a7z8-2fzy-2qee","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nStored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25145","reference_id":"","reference_type":"","scores":[{"value":"0.00152","scoring_system":"epss","scoring_elements":"0.35713","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00152","scoring_system":"epss","scoring_elements":"0.35702","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25145"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25145","reference_id":"CVE-2024-25145","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-08T17:02:17Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25145"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25145","reference_id":"CVE-2024-25145","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25145"},{"reference_url":"https://github.com/advisories/GHSA-9vgq-w5pv-v77q","reference_id":"GHSA-9vgq-w5pv-v77q","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-9vgq-w5pv-v77q"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/68810?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.12"}],"aliases":["CVE-2024-25145","GHSA-9vgq-w5pv-v77q"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-a7z8-2fzy-2qee"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/109005?format=json","vulnerability_id":"VCID-afe9-yqy2-8bdb","summary":"Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented\nHtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.","references":[{"reference_url":"http://liferay.com","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T16:00:44Z/"}],"url":"http://liferay.com"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-28977","reference_id":"","reference_type":"","scores":[{"value":"0.0051","scoring_system":"epss","scoring_elements":"0.66823","published_at":"2026-06-06T12:55:00Z"},{"value":"0.0051","scoring_system":"epss","scoring_elements":"0.66775","published_at":"2026-06-04T12:55:00Z"},{"value":"0.0051","scoring_system":"epss","scoring_elements":"0.66815","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-28977"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/242e8bcabe3e8767799d3d1e6c021a75b4ada11b","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/242e8bcabe3e8767799d3d1e6c021a75b4ada11b"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/6389885476414d3cd9e3092b4708906a5bdc8a48","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/6389885476414d3cd9e3092b4708906a5bdc8a48"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/8aa3fd76f34d1a4562bd5b4f82931a0a124e31a8","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/8aa3fd76f34d1a4562bd5b4f82931a0a124e31a8"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-17327","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-17327"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-28977?p_r_p_assetEntryId=121612261&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612261%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-28977?p_r_p_assetEntryId=121612261&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612261%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28977","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28977"},{"reference_url":"https://web.archive.org/web/20220922060039/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20220922060039/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash"},{"reference_url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash","reference_id":"cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T16:00:44Z/"}],"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash"},{"reference_url":"https://github.com/advisories/GHSA-w397-9p2j-6x23","reference_id":"GHSA-w397-9p2j-6x23","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-w397-9p2j-6x23"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69044?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4-ga4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4-ga4"},{"url":"http://public2.vulnerablecode.io/api/packages/69097?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5"}],"aliases":["CVE-2022-28977","GHSA-w397-9p2j-6x23"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-afe9-yqy2-8bdb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/48156?format=json","vulnerability_id":"VCID-b24q-c9nx-hkdy","summary":"Liferay Portal Stores Password Reset Tokens in Plain Text\nLiferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62261","reference_id":"","reference_type":"","scores":[{"value":"0.00025","scoring_system":"epss","scoring_elements":"0.07658","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00025","scoring_system":"epss","scoring_elements":"0.07648","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62261"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/b228c7878f2ed5ad8dbc1ff7ec9b5e6d53bb4b5c","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/b228c7878f2ed5ad8dbc1ff7ec9b5e6d53bb4b5c"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-17785","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-17785"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62261","reference_id":"CVE-2025-62261","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-28T14:27:39Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62261"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62261","reference_id":"CVE-2025-62261","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62261"},{"reference_url":"https://github.com/advisories/GHSA-xcj6-xpjg-c4xr","reference_id":"GHSA-xcj6-xpjg-c4xr","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xcj6-xpjg-c4xr"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69070?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-3hm3-htje-akgd"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ej5y-geq1-pkfn"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mbd8-z3ry-cqap"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-rs2y-3c75-uycm"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-su57-hncy-5qg4"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100"}],"aliases":["CVE-2025-62261","GHSA-xcj6-xpjg-c4xr"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-b24q-c9nx-hkdy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47075?format=json","vulnerability_id":"VCID-b7h9-cxkj-hkc8","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nStored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the filename of an attachment.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25152","reference_id":"","reference_type":"","scores":[{"value":"0.00152","scoring_system":"epss","scoring_elements":"0.35713","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00152","scoring_system":"epss","scoring_elements":"0.35702","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25152"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25152","reference_id":"CVE-2024-25152","reference_type":"","scores":[{"value":"9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-21T19:54:47Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25152"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25152","reference_id":"CVE-2024-25152","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25152"},{"reference_url":"https://github.com/advisories/GHSA-p28x-4r5h-ph6j","reference_id":"GHSA-p28x-4r5h-ph6j","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-p28x-4r5h-ph6j"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/609681?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-266t-4gfq-duh4"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-37ph-hjq9-bufq"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-afe9-yqy2-8bdb"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-bbzr-zx1c-m3ck"},{"vulnerability":"VCID-bg89-tyhn-sfc3"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-pczz-39pz-37bb"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-xuaz-p5q4-8beh"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-y8xm-g4zt-b7b5"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"},{"vulnerability":"VCID-zmf4-acz8-s3a2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1"}],"aliases":["CVE-2024-25152","GHSA-p28x-4r5h-ph6j"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-b7h9-cxkj-hkc8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/110134?format=json","vulnerability_id":"VCID-bbzr-zx1c-m3ck","summary":"Incorrect Default Permissions in Liferay Portal\nThe Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.","references":[{"reference_url":"http://liferay.com","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:26:08Z/"}],"url":"http://liferay.com"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42128","reference_id":"","reference_type":"","scores":[{"value":"0.00186","scoring_system":"epss","scoring_elements":"0.40266","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00186","scoring_system":"epss","scoring_elements":"0.40181","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00186","scoring_system":"epss","scoring_elements":"0.40263","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42128"},{"reference_url":"https://issues.liferay.com/browse/LPE-17595","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:26:08Z/"}],"url":"https://issues.liferay.com/browse/LPE-17595"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42128","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42128"},{"reference_url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42128","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:26:08Z/"}],"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42128"},{"reference_url":"https://github.com/advisories/GHSA-wgqm-qp44-cg6x","reference_id":"GHSA-wgqm-qp44-cg6x","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wgqm-qp44-cg6x"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69097?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5"}],"aliases":["CVE-2022-42128","GHSA-wgqm-qp44-cg6x"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-bbzr-zx1c-m3ck"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/110318?format=json","vulnerability_id":"VCID-bg89-tyhn-sfc3","summary":"Authorization Bypass in Liferay Portal\nAn Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.","references":[{"reference_url":"http://liferay.com","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T18:27:45Z/"}],"url":"http://liferay.com"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42129","reference_id":"","reference_type":"","scores":[{"value":"0.00191","scoring_system":"epss","scoring_elements":"0.40841","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00191","scoring_system":"epss","scoring_elements":"0.40759","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00191","scoring_system":"epss","scoring_elements":"0.40837","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42129"},{"reference_url":"https://issues.liferay.com/browse/LPE-17448","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T18:27:45Z/"}],"url":"https://issues.liferay.com/browse/LPE-17448"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42129","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42129"},{"reference_url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42129","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T18:27:45Z/"}],"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42129"},{"reference_url":"https://github.com/advisories/GHSA-g6x4-57hp-j4xm","reference_id":"GHSA-g6x4-57hp-j4xm","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-g6x4-57hp-j4xm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69097?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5"}],"aliases":["CVE-2022-42129","GHSA-g6x4-57hp-j4xm"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-bg89-tyhn-sfc3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57899?format=json","vulnerability_id":"VCID-by7b-2zr9-y3dj","summary":"Liferay Portal CSRF Vulnerability via Endpoint Parameter\nA CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote attackers to performs cross-origin request on behalf of the authenticated user via the endpoint parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43745","reference_id":"","reference_type":"","scores":[{"value":"0.00036","scoring_system":"epss","scoring_elements":"0.111","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00036","scoring_system":"epss","scoring_elements":"0.11093","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43745"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/037b58f96c9ded47960ab493a68d68aaf32b1a43","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/037b58f96c9ded47960ab493a68d68aaf32b1a43"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/2387ee78fd471ea1c1c4d696aa0cbb1bce72665e","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/2387ee78fd471ea1c1c4d696aa0cbb1bce72665e"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/729dfc202c9d2724b5f3f749ead14eb13832e101","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/729dfc202c9d2724b5f3f749ead14eb13832e101"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18275","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18275"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43745","reference_id":"CVE-2025-43745","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-19T19:15:28Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43745"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43745","reference_id":"CVE-2025-43745","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43745"},{"reference_url":"https://github.com/advisories/GHSA-7q33-gwcm-r6cj","reference_id":"GHSA-7q33-gwcm-r6cj","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-7q33-gwcm-r6cj"}],"fixed_packages":[],"aliases":["CVE-2025-43745","GHSA-7q33-gwcm-r6cj"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-by7b-2zr9-y3dj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57807?format=json","vulnerability_id":"VCID-ca62-h2qv-v7bg","summary":"Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery\nAn SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-4655","reference_id":"","reference_type":"","scores":[{"value":"0.00167","scoring_system":"epss","scoring_elements":"0.37668","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00167","scoring_system":"epss","scoring_elements":"0.37665","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-4655"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4655","reference_id":"CVE-2025-4655","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-11T18:52:11Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4655"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4655","reference_id":"CVE-2025-4655","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4655"},{"reference_url":"https://github.com/advisories/GHSA-c6g5-g6r7-q4j6","reference_id":"GHSA-c6g5-g6r7-q4j6","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-c6g5-g6r7-q4j6"}],"fixed_packages":[],"aliases":["CVE-2025-4655","GHSA-c6g5-g6r7-q4j6"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ca62-h2qv-v7bg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47976?format=json","vulnerability_id":"VCID-ce9p-rwsz-zkf6","summary":"Liferay Portal is vulnerable to Stored XSS through Forms text type field\nStored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form with a rich text type field.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43830","reference_id":"","reference_type":"","scores":[{"value":"0.00031","scoring_system":"epss","scoring_elements":"0.09338","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00031","scoring_system":"epss","scoring_elements":"0.09319","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43830"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43830","reference_id":"CVE-2025-43830","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-08T13:36:35Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43830"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43830","reference_id":"CVE-2025-43830","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43830"},{"reference_url":"https://github.com/advisories/GHSA-378f-8q54-3fqx","reference_id":"GHSA-378f-8q54-3fqx","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-378f-8q54-3fqx"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/70671?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112"}],"aliases":["CVE-2025-43830","GHSA-378f-8q54-3fqx"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ce9p-rwsz-zkf6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/56356?format=json","vulnerability_id":"VCID-cj4m-mvzh-ckh4","summary":"Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting\nReflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.1.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38, 7.3 GA through update 36, 7.2 GA through fix pack 20 and 7.1 GA through fix pack 28 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-11993","reference_id":"","reference_type":"","scores":[{"value":"0.00175","scoring_system":"epss","scoring_elements":"0.38799","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00175","scoring_system":"epss","scoring_elements":"0.38795","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-11993"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"4.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993","reference_id":"CVE-2024-11993","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"4.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-17T21:24:48Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11993","reference_id":"CVE-2024-11993","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"4.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11993"},{"reference_url":"https://github.com/advisories/GHSA-4hxr-28mv-q729","reference_id":"GHSA-4hxr-28mv-q729","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-4hxr-28mv-q729"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/83550?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.39","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-3hm3-htje-akgd"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dvp1-5vf5-qfg9"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ej5y-geq1-pkfn"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.39"}],"aliases":["CVE-2024-11993","GHSA-4hxr-28mv-q729"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-cj4m-mvzh-ckh4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/110185?format=json","vulnerability_id":"VCID-dt2w-w4vw-1yhe","summary":"Path Traversal in Liferay Portal\nA Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19 allows attackers to create or overwrite existing files on the filesystem via the installation of a malicious Elasticsearch Sidecar plugin.","references":[{"reference_url":"http://liferay.com","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:56:31Z/"}],"url":"http://liferay.com"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42123","reference_id":"","reference_type":"","scores":[{"value":"0.00418","scoring_system":"epss","scoring_elements":"0.62181","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00418","scoring_system":"epss","scoring_elements":"0.62124","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00418","scoring_system":"epss","scoring_elements":"0.62173","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42123"},{"reference_url":"https://issues.liferay.com/browse/LPE-17518","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:56:31Z/"}],"url":"https://issues.liferay.com/browse/LPE-17518"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42123","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42123"},{"reference_url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42123","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:56:31Z/"}],"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42123"},{"reference_url":"https://github.com/advisories/GHSA-hffx-r282-w2g9","reference_id":"GHSA-hffx-r282-w2g9","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hffx-r282-w2g9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/148688?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ej5y-geq1-pkfn"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.19"}],"aliases":["CVE-2022-42123","GHSA-hffx-r282-w2g9"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dt2w-w4vw-1yhe"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47061?format=json","vulnerability_id":"VCID-e5c7-wsvb-dyfm","summary":"Liferay Portal and Liferay DXP HTTP Header Can Expose Versions\nIn Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity` is set to `full`, which allows remote attackers to easily identify the version of the application that is running and the vulnerabilities that affect that version via 'Liferay-Portal` response header.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26267","reference_id":"","reference_type":"","scores":[{"value":"0.00224","scoring_system":"epss","scoring_elements":"0.45205","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00224","scoring_system":"epss","scoring_elements":"0.45202","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26267"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/00750dade0cc81efc380fcc6d7e2f58060c4ad95","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/00750dade0cc81efc380fcc6d7e2f58060c4ad95"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/0e881cac66db14a11673c0352def6df04f77d35c","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/0e881cac66db14a11673c0352def6df04f77d35c"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9658cec331feaaaad8bf93c6f65e1768a1f43ae2","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9658cec331feaaaad8bf93c6f65e1768a1f43ae2"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26267","reference_id":"CVE-2024-26267","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T15:20:52Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26267"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26267","reference_id":"CVE-2024-26267","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26267"},{"reference_url":"https://github.com/advisories/GHSA-2mvj-q2q3-wxjv","reference_id":"GHSA-2mvj-q2q3-wxjv","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-2mvj-q2q3-wxjv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69048?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.26-ga26","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.26-ga26"},{"url":"http://public2.vulnerablecode.io/api/packages/68840?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dvp1-5vf5-qfg9"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ej5y-geq1-pkfn"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27"}],"aliases":["CVE-2024-26267","GHSA-2mvj-q2q3-wxjv"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-e5c7-wsvb-dyfm"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/56369?format=json","vulnerability_id":"VCID-e5h2-wvws-3yhq","summary":"Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page\nCross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's `Service Class` text field.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-37940","reference_id":"","reference_type":"","scores":[{"value":"0.00175","scoring_system":"epss","scoring_elements":"0.38795","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00175","scoring_system":"epss","scoring_elements":"0.38799","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-37940"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940","reference_id":"CVE-2023-37940","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-17T21:41:20Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37940","reference_id":"CVE-2023-37940","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37940"},{"reference_url":"https://github.com/advisories/GHSA-px38-239g-x5mg","reference_id":"GHSA-px38-239g-x5mg","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-px38-239g-x5mg"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/83576?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.88","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-3hm3-htje-akgd"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ej5y-geq1-pkfn"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mbd8-z3ry-cqap"},{"vulnerability":"VCID-mf9a-eusx-f3gb"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-rs2y-3c75-uycm"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-su57-hncy-5qg4"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-xv4h-g41b-c7c7"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.88"}],"aliases":["CVE-2023-37940","GHSA-px38-239g-x5mg"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-e5h2-wvws-3yhq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57144?format=json","vulnerability_id":"VCID-ebzh-bpks-5qe2","summary":"Liferay Cross-site Scripting vulnerability\nA stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-3760","reference_id":"","reference_type":"","scores":[{"value":"0.00157","scoring_system":"epss","scoring_elements":"0.363","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00157","scoring_system":"epss","scoring_elements":"0.36309","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-3760"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3760","reference_id":"CVE-2025-3760","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-17T13:22:03Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3760"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3760","reference_id":"CVE-2025-3760","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3760"},{"reference_url":"https://github.com/advisories/GHSA-qhp6-vp7c-g7xp","reference_id":"GHSA-qhp6-vp7c-g7xp","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-qhp6-vp7c-g7xp"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/84867?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-u1pr-9cpx-q3hg"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132"}],"aliases":["CVE-2025-3760","GHSA-qhp6-vp7c-g7xp"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ebzh-bpks-5qe2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57878?format=json","vulnerability_id":"VCID-evap-nt9g-akf6","summary":"Liferay Portal Vulnerable to Cross-Site Scripting\nA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43731","reference_id":"","reference_type":"","scores":[{"value":"0.00048","scoring_system":"epss","scoring_elements":"0.15376","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00048","scoring_system":"epss","scoring_elements":"0.15367","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43731"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/41708aa542c103521427ecf06f4b20cb37c65ecf","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/41708aa542c103521427ecf06f4b20cb37c65ecf"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/cd1c692dfed3bbebe10074ecb89c561893fffaf9","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/cd1c692dfed3bbebe10074ecb89c561893fffaf9"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/f23921fc93cf713f27ed9c4d31b8c1854c0e2abb","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/f23921fc93cf713f27ed9c4d31b8c1854c0e2abb"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18217","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18217"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18219","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18219"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43731","reference_id":"CVE-2025-43731","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-18T18:37:36Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43731"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43731","reference_id":"CVE-2025-43731","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43731"},{"reference_url":"https://github.com/advisories/GHSA-3p2m-574v-v257","reference_id":"GHSA-3p2m-574v-v257","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-3p2m-574v-v257"}],"fixed_packages":[],"aliases":["CVE-2025-43731","GHSA-3p2m-574v-v257"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-evap-nt9g-akf6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57815?format=json","vulnerability_id":"VCID-g41m-xvk2-xfda","summary":"Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability\nA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43734","reference_id":"","reference_type":"","scores":[{"value":"0.00048","scoring_system":"epss","scoring_elements":"0.15367","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00048","scoring_system":"epss","scoring_elements":"0.15376","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43734"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/b4ca1bb0961cc1f230508e072c30815eabce062f","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/b4ca1bb0961cc1f230508e072c30815eabce062f"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18234","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18234"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43734","reference_id":"CVE-2025-43734","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-12T19:00:01Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43734"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43734","reference_id":"CVE-2025-43734","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43734"},{"reference_url":"https://github.com/advisories/GHSA-m5c7-5gv3-hcpf","reference_id":"GHSA-m5c7-5gv3-hcpf","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-m5c7-5gv3-hcpf"}],"fixed_packages":[],"aliases":["CVE-2025-43734","GHSA-m5c7-5gv3-hcpf"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-g41m-xvk2-xfda"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/45257?format=json","vulnerability_id":"VCID-gaqh-vn1h-b3c1","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's `URL` text field.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33944","reference_id":"","reference_type":"","scores":[{"value":"0.00304","scoring_system":"epss","scoring_elements":"0.5399","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00304","scoring_system":"epss","scoring_elements":"0.53997","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33944"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33944","reference_id":"CVE-2023-33944","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-22T15:45:15Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33944"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33944","reference_id":"CVE-2023-33944","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33944"},{"reference_url":"https://github.com/advisories/GHSA-pfwc-4frf-4gf8","reference_id":"GHSA-pfwc-4frf-4gf8","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-pfwc-4frf-4gf8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65215?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.69","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-3hm3-htje-akgd"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ej5y-geq1-pkfn"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mbd8-z3ry-cqap"},{"vulnerability":"VCID-mf9a-eusx-f3gb"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-uun9-ctyg-k3d9"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.69"}],"aliases":["CVE-2023-33944","GHSA-pfwc-4frf-4gf8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gaqh-vn1h-b3c1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57808?format=json","vulnerability_id":"VCID-ggmh-6ef8-7ufj","summary":"Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery\nLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allow a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web component due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-4581","reference_id":"","reference_type":"","scores":[{"value":"0.00195","scoring_system":"epss","scoring_elements":"0.41279","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00195","scoring_system":"epss","scoring_elements":"0.41283","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-4581"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4581","reference_id":"CVE-2025-4581","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-11T18:52:25Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4581"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4581","reference_id":"CVE-2025-4581","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4581"},{"reference_url":"https://github.com/advisories/GHSA-6v93-frf9-2rp8","reference_id":"GHSA-6v93-frf9-2rp8","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-6v93-frf9-2rp8"}],"fixed_packages":[],"aliases":["CVE-2025-4581","GHSA-6v93-frf9-2rp8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ggmh-6ef8-7ufj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/46979?format=json","vulnerability_id":"VCID-ggs5-4zac-vqa7","summary":"Liferay Portal denial-of-service vulnerability\nThe IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25144","reference_id":"","reference_type":"","scores":[{"value":"0.00318","scoring_system":"epss","scoring_elements":"0.55172","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00318","scoring_system":"epss","scoring_elements":"0.55165","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25144"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L"},{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25144","reference_id":"CVE-2024-25144","reference_type":"","scores":[{"value":"4.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L"},{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-08T20:11:12Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25144"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25144","reference_id":"CVE-2024-25144","reference_type":"","scores":[{"value":"4.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L"},{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25144"},{"reference_url":"https://github.com/advisories/GHSA-w275-m8cr-hf2v","reference_id":"GHSA-w275-m8cr-hf2v","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-w275-m8cr-hf2v"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/68840?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dvp1-5vf5-qfg9"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ej5y-geq1-pkfn"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27"}],"aliases":["CVE-2024-25144","GHSA-w275-m8cr-hf2v"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ggs5-4zac-vqa7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57938?format=json","vulnerability_id":"VCID-gyge-7d5c-6uhz","summary":"Liferay Portal's Unlimited File Upload Could Result in DoS\nLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the object entries attachment fields, the files are stored in the document_library allowing an attacker to cause a potential DDoS.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43752","reference_id":"","reference_type":"","scores":[{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.28956","published_at":"2026-06-05T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.2892","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43752"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/45dda30252d83912307491d8ed8802577871fa25","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/45dda30252d83912307491d8ed8802577871fa25"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/f3e4723acdf15d3f690d401d6eb6a5653e5be391","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/f3e4723acdf15d3f690d401d6eb6a5653e5be391"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/fffed67b3fd1cc6071fd25a9b104b7691ffea2f8","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/fffed67b3fd1cc6071fd25a9b104b7691ffea2f8"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18188","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18188"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43752","reference_id":"CVE-2025-43752","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-22T11:27:55Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43752"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43752","reference_id":"CVE-2025-43752","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43752"},{"reference_url":"https://github.com/advisories/GHSA-qpp6-f3qj-rggq","reference_id":"GHSA-qpp6-f3qj-rggq","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-qpp6-f3qj-rggq"}],"fixed_packages":[],"aliases":["CVE-2025-43752","GHSA-qpp6-f3qj-rggq"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gyge-7d5c-6uhz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47080?format=json","vulnerability_id":"VCID-h261-uqtv-yfek","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nStored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into an organization’s “Name” text field","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25602","reference_id":"","reference_type":"","scores":[{"value":"0.00471","scoring_system":"epss","scoring_elements":"0.65007","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00471","scoring_system":"epss","scoring_elements":"0.64997","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25602"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25602","reference_id":"CVE-2024-25602","reference_type":"","scores":[{"value":"9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T15:23:34Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25602"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25602","reference_id":"CVE-2024-25602","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25602"},{"reference_url":"https://github.com/advisories/GHSA-v2xq-m22w-jmpr","reference_id":"GHSA-v2xq-m22w-jmpr","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-v2xq-m22w-jmpr"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/609681?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-266t-4gfq-duh4"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-37ph-hjq9-bufq"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-afe9-yqy2-8bdb"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-bbzr-zx1c-m3ck"},{"vulnerability":"VCID-bg89-tyhn-sfc3"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-pczz-39pz-37bb"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-xuaz-p5q4-8beh"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-y8xm-g4zt-b7b5"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"},{"vulnerability":"VCID-zmf4-acz8-s3a2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1"}],"aliases":["CVE-2024-25602","GHSA-v2xq-m22w-jmpr"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-h261-uqtv-yfek"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47049?format=json","vulnerability_id":"VCID-hhmu-vsj9-gudx","summary":"Liferay Portal has a Stored XSS with Blog entries (Insecure defaults)\nIn Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entry’s content text field.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25610","reference_id":"","reference_type":"","scores":[{"value":"0.00106","scoring_system":"epss","scoring_elements":"0.28288","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00106","scoring_system":"epss","scoring_elements":"0.28338","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25610"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25610","reference_id":"CVE-2024-25610","reference_type":"","scores":[{"value":"9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-08-28T13:32:33Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25610"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25610","reference_id":"CVE-2024-25610","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25610"},{"reference_url":"https://github.com/advisories/GHSA-vvpf-53qx-cxhh","reference_id":"GHSA-vvpf-53qx-cxhh","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vvpf-53qx-cxhh"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65209?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13"}],"aliases":["CVE-2024-25610","GHSA-vvpf-53qx-cxhh"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hhmu-vsj9-gudx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47078?format=json","vulnerability_id":"VCID-hrnu-4t2j-9qba","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25147","reference_id":"","reference_type":"","scores":[{"value":"0.00147","scoring_system":"epss","scoring_elements":"0.34843","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00147","scoring_system":"epss","scoring_elements":"0.34827","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25147"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25147","reference_id":"CVE-2024-25147","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-21T16:15:43Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25147"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25147","reference_id":"CVE-2024-25147","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25147"},{"reference_url":"https://github.com/advisories/GHSA-xpjg-7hx7-wgcx","reference_id":"GHSA-xpjg-7hx7-wgcx","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xpjg-7hx7-wgcx"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/609680?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.1-1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-266t-4gfq-duh4"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2fn6-apud-qbh4"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-37ph-hjq9-bufq"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4mcy-yw2p-v7bd"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8jv6-163j-a7b2"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-afe9-yqy2-8bdb"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-b7h9-cxkj-hkc8"},{"vulnerability":"VCID-bbzr-zx1c-m3ck"},{"vulnerability":"VCID-bg89-tyhn-sfc3"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-h261-uqtv-yfek"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-hw1d-gdcv-vkec"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-p9am-1rhf-6bh2"},{"vulnerability":"VCID-pczz-39pz-37bb"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-xuaz-p5q4-8beh"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-y8xm-g4zt-b7b5"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"},{"vulnerability":"VCID-zmf4-acz8-s3a2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.1-1"}],"aliases":["CVE-2024-25147","GHSA-xpjg-7hx7-wgcx"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hrnu-4t2j-9qba"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/56043?format=json","vulnerability_id":"VCID-hvpx-y297-sbha","summary":"Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor\nCross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the p_l_back_url parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26272","reference_id":"","reference_type":"","scores":[{"value":"0.03261","scoring_system":"epss","scoring_elements":"0.87402","published_at":"2026-06-06T12:55:00Z"},{"value":"0.06126","scoring_system":"epss","scoring_elements":"0.90964","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26272"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26272","reference_id":"CVE-2024-26272","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:15:06Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26272"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26272","reference_id":"CVE-2024-26272","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26272"},{"reference_url":"https://github.com/advisories/GHSA-p63m-vmjr-wg37","reference_id":"GHSA-p63m-vmjr-wg37","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-p63m-vmjr-wg37"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/71164?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108"},{"url":"http://public2.vulnerablecode.io/api/packages/69927?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-su57-hncy-5qg4"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112"}],"aliases":["CVE-2024-26272","GHSA-p63m-vmjr-wg37"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hvpx-y297-sbha"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/46974?format=json","vulnerability_id":"VCID-hw1d-gdcv-vkec","summary":"Liferay Portal vulnerable to user impersonation\nIn Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user. This may allow remote authenticated users to impersonate a user after accessing the linked content.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25148","reference_id":"","reference_type":"","scores":[{"value":"0.00433","scoring_system":"epss","scoring_elements":"0.63146","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00433","scoring_system":"epss","scoring_elements":"0.63137","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25148"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25148","reference_id":"CVE-2024-25148","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-21T17:33:36Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25148"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25148","reference_id":"CVE-2024-25148","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25148"},{"reference_url":"https://github.com/advisories/GHSA-qwj8-qgpr-8crm","reference_id":"GHSA-qwj8-qgpr-8crm","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qwj8-qgpr-8crm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/68824?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-266t-4gfq-duh4"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2fn6-apud-qbh4"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-37ph-hjq9-bufq"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4mcy-yw2p-v7bd"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8jv6-163j-a7b2"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-afe9-yqy2-8bdb"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-b7h9-cxkj-hkc8"},{"vulnerability":"VCID-bbzr-zx1c-m3ck"},{"vulnerability":"VCID-bg89-tyhn-sfc3"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-h261-uqtv-yfek"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-pczz-39pz-37bb"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-xuaz-p5q4-8beh"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-y8xm-g4zt-b7b5"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"},{"vulnerability":"VCID-zmf4-acz8-s3a2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2"}],"aliases":["CVE-2024-25148","GHSA-qwj8-qgpr-8crm"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hw1d-gdcv-vkec"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57887?format=json","vulnerability_id":"VCID-j3pc-gwg6-qfbs","summary":"Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels\nA stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 exists in the Asset Publisher configuration UI within the Source.js module. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels which are then inserted into the DOM using innerHTML without proper encoding.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43744","reference_id":"","reference_type":"","scores":[{"value":"0.0005","scoring_system":"epss","scoring_elements":"0.15904","published_at":"2026-06-06T12:55:00Z"},{"value":"0.0005","scoring_system":"epss","scoring_elements":"0.15915","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43744"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/3b36fadfe92437deab4a55029a1a369e046f3829","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/3b36fadfe92437deab4a55029a1a369e046f3829"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/c07a490b3d3759f38c5473cda74e99540bd0235e","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/c07a490b3d3759f38c5473cda74e99540bd0235e"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18271","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18271"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43744","reference_id":"CVE-2025-43744","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T14:14:31Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43744"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43744","reference_id":"CVE-2025-43744","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43744"},{"reference_url":"https://github.com/advisories/GHSA-m49p-6cjp-x2h3","reference_id":"GHSA-m49p-6cjp-x2h3","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-m49p-6cjp-x2h3"}],"fixed_packages":[],"aliases":["CVE-2025-43744","GHSA-m49p-6cjp-x2h3"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-j3pc-gwg6-qfbs"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/110228?format=json","vulnerability_id":"VCID-k1u8-ur3y-zucd","summary":"Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL\nThe Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.","references":[{"reference_url":"http://liferay.com","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:17:39Z/"}],"url":"http://liferay.com"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42132","reference_id":"","reference_type":"","scores":[{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.5606","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.56121","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00328","scoring_system":"epss","scoring_elements":"0.56115","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42132"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/4a53b64fb714c7ff989b99ddccc3de116095453d","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/4a53b64fb714c7ff989b99ddccc3de116095453d"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/b6cff511119d71dea38f5485761730f4fb5d4430","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/b6cff511119d71dea38f5485761730f4fb5d4430"},{"reference_url":"https://issues.liferay.com/browse/LPE-17438","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:17:39Z/"}],"url":"https://issues.liferay.com/browse/LPE-17438"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42132?p_r_p_assetEntryId=121613918&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613918%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42132?p_r_p_assetEntryId=121613918&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613918%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42132","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42132"},{"reference_url":"https://web.archive.org/web/20221020134303/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42132","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20221020134303/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42132"},{"reference_url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42132","reference_id":"cve-2022-42132","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:17:39Z/"}],"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42132"},{"reference_url":"https://github.com/advisories/GHSA-f43m-hhj4-q3jg","reference_id":"GHSA-f43m-hhj4-q3jg","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-f43m-hhj4-q3jg"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69030?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5-ga5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5-ga5"},{"url":"http://public2.vulnerablecode.io/api/packages/609682?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6"}],"aliases":["CVE-2022-42132","GHSA-f43m-hhj4-q3jg"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-k1u8-ur3y-zucd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47065?format=json","vulnerability_id":"VCID-k9yt-aj7x-3bht","summary":"Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement Character\nHtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25608","reference_id":"","reference_type":"","scores":[{"value":"0.1765","scoring_system":"epss","scoring_elements":"0.95236","published_at":"2026-06-06T12:55:00Z"},{"value":"0.1765","scoring_system":"epss","scoring_elements":"0.95235","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25608"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/36adf82ef7a09c7035d4f19a1982dcde1ae3f6ae","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/36adf82ef7a09c7035d4f19a1982dcde1ae3f6ae"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/aea651fa5110934b6a00d93391fac87985e27786","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/aea651fa5110934b6a00d93391fac87985e27786"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25608","reference_id":"CVE-2024-25608","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T17:50:15Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25608"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25608","reference_id":"CVE-2024-25608","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25608"},{"reference_url":"https://github.com/advisories/GHSA-548x-j6x6-hcv4","reference_id":"GHSA-548x-j6x6-hcv4","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-548x-j6x6-hcv4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69072?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.19-ga19","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.19-ga19"},{"url":"http://public2.vulnerablecode.io/api/packages/609688?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.20","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ej5y-geq1-pkfn"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.20"}],"aliases":["CVE-2024-25608","GHSA-548x-j6x6-hcv4"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-k9yt-aj7x-3bht"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47062?format=json","vulnerability_id":"VCID-kjbx-n3pd-yba9","summary":"Liferay Portal vulnerable to Denial of Service\nThe Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, which allows remote authenticated users to upload arbitrarily large files to the system's temp folder by modifying the `maxFileSize` parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26265","reference_id":"","reference_type":"","scores":[{"value":"0.00688","scoring_system":"epss","scoring_elements":"0.72171","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00688","scoring_system":"epss","scoring_elements":"0.72164","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26265"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L"},{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26265","reference_id":"CVE-2024-26265","reference_type":"","scores":[{"value":"5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L"},{"value":"5.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L"},{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T19:41:28Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26265"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26265","reference_id":"CVE-2024-26265","reference_type":"","scores":[{"value":"5.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L"},{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26265"},{"reference_url":"https://github.com/advisories/GHSA-29xx-fhff-36m7","reference_id":"GHSA-29xx-fhff-36m7","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-29xx-fhff-36m7"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69051?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.16","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.16"}],"aliases":["CVE-2024-26265","GHSA-29xx-fhff-36m7"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kjbx-n3pd-yba9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57884?format=json","vulnerability_id":"VCID-ksvn-b6hv-hfa7","summary":"Liferay Portal Enumeration Discrepancy in Calendars\nLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated remote user to view other calendars by allowing them to enumerate the names of other users, given an attacker the possibility to send phishing to these users.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43743","reference_id":"","reference_type":"","scores":[{"value":"0.00081","scoring_system":"epss","scoring_elements":"0.2395","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00081","scoring_system":"epss","scoring_elements":"0.23967","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43743"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/02528147664475cd9f7205cd8bc05dfd43832201","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/02528147664475cd9f7205cd8bc05dfd43832201"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/144e4a276e456c4b7a0831ff038241f82a9181db","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/144e4a276e456c4b7a0831ff038241f82a9181db"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/1513ed29f830c9119ee6be623ae783e545da4845","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/1513ed29f830c9119ee6be623ae783e545da4845"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/1e368205c710403e76749e38127419780acdda9d","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/1e368205c710403e76749e38127419780acdda9d"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/7d6e1bccb62a41e944e0459d2c4b1eb9fdb31b8e","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/7d6e1bccb62a41e944e0459d2c4b1eb9fdb31b8e"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9a88f7fa98f9fc11a9eab444a256204cccc82b77","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9a88f7fa98f9fc11a9eab444a256204cccc82b77"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9aba859a6956786bcd8ce434ef063eed01b5ec6e","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9aba859a6956786bcd8ce434ef063eed01b5ec6e"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/bd89933cc9022a98fc34b562ce3573a58f14cf38","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/bd89933cc9022a98fc34b562ce3573a58f14cf38"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/d999a8e1902e88fdd7a26758f137925d969a639d","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/d999a8e1902e88fdd7a26758f137925d969a639d"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18206","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18206"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43743","reference_id":"CVE-2025-43743","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-19T19:28:02Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43743"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43743","reference_id":"CVE-2025-43743","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43743"},{"reference_url":"https://github.com/advisories/GHSA-g4vp-4gqr-7v8c","reference_id":"GHSA-g4vp-4gqr-7v8c","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-g4vp-4gqr-7v8c"}],"fixed_packages":[],"aliases":["CVE-2025-43743","GHSA-g4vp-4gqr-7v8c"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ksvn-b6hv-hfa7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47063?format=json","vulnerability_id":"VCID-mcea-q7za-duay","summary":"Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions\nLiferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25604","reference_id":"","reference_type":"","scores":[{"value":"0.00089","scoring_system":"epss","scoring_elements":"0.25436","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00089","scoring_system":"epss","scoring_elements":"0.2545","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25604"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/4a196df20e180be76944cd0c623df486379d7724","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/4a196df20e180be76944cd0c623df486379d7724"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/f028316fa975d2e13bed7ef49d69ab77f412765e","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/f028316fa975d2e13bed7ef49d69ab77f412765e"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25604","reference_id":"CVE-2024-25604","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T18:38:45Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25604"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25604","reference_id":"CVE-2024-25604","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25604"},{"reference_url":"https://github.com/advisories/GHSA-pw7p-3648-qqmg","reference_id":"GHSA-pw7p-3648-qqmg","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-pw7p-3648-qqmg"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69030?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5-ga5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5-ga5"},{"url":"http://public2.vulnerablecode.io/api/packages/609682?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6"}],"aliases":["CVE-2024-25604","GHSA-pw7p-3648-qqmg"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-mcea-q7za-duay"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/109058?format=json","vulnerability_id":"VCID-msd2-mccp-z7cv","summary":"Liferay Portal Missing Authorization vulnerability\nThe Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a \"Content Page\" type page, allowing attackers to view unpublished \"Content Page\" pages via URL manipulation.","references":[{"reference_url":"http://liferay.com","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T18:55:52Z/"}],"url":"http://liferay.com"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-39975","reference_id":"","reference_type":"","scores":[{"value":"0.00157","scoring_system":"epss","scoring_elements":"0.36372","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00157","scoring_system":"epss","scoring_elements":"0.36269","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00157","scoring_system":"epss","scoring_elements":"0.36363","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-39975"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39975","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39975"},{"reference_url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-39975","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T18:55:52Z/"}],"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-39975"},{"reference_url":"https://github.com/advisories/GHSA-83qx-288m-72w4","reference_id":"GHSA-83qx-288m-72w4","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-83qx-288m-72w4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/145625?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.35","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dvp1-5vf5-qfg9"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ej5y-geq1-pkfn"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.35"}],"aliases":["CVE-2022-39975","GHSA-83qx-288m-72w4"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-msd2-mccp-z7cv"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57820?format=json","vulnerability_id":"VCID-nhp5-61h7-ryf4","summary":"Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability\nA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43735","reference_id":"","reference_type":"","scores":[{"value":"0.0007","scoring_system":"epss","scoring_elements":"0.21664","published_at":"2026-06-05T12:55:00Z"},{"value":"0.0007","scoring_system":"epss","scoring_elements":"0.2165","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43735"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/64d19e457ffc9876fd159a907741618843d7aadb","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/64d19e457ffc9876fd159a907741618843d7aadb"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18158","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18158"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43735","reference_id":"CVE-2025-43735","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-12T13:31:05Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43735"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43735","reference_id":"CVE-2025-43735","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43735"},{"reference_url":"https://github.com/advisories/GHSA-222w-xmc5-jhp3","reference_id":"GHSA-222w-xmc5-jhp3","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-222w-xmc5-jhp3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/84867?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-u1pr-9cpx-q3hg"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132"}],"aliases":["CVE-2025-43735","GHSA-222w-xmc5-jhp3"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-nhp5-61h7-ryf4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/46977?format=json","vulnerability_id":"VCID-p9am-1rhf-6bh2","summary":"Observable Response Discrepancy\nLiferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25146","reference_id":"","reference_type":"","scores":[{"value":"0.00388","scoring_system":"epss","scoring_elements":"0.60238","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00388","scoring_system":"epss","scoring_elements":"0.60235","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25146"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146","reference_id":"CVE-2024-25146","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-08T15:42:08Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25146","reference_id":"CVE-2024-25146","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25146"},{"reference_url":"https://github.com/advisories/GHSA-mqf8-4cqm-p83x","reference_id":"GHSA-mqf8-4cqm-p83x","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mqf8-4cqm-p83x"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/68824?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-266t-4gfq-duh4"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2fn6-apud-qbh4"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-37ph-hjq9-bufq"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4mcy-yw2p-v7bd"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8jv6-163j-a7b2"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-afe9-yqy2-8bdb"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-b7h9-cxkj-hkc8"},{"vulnerability":"VCID-bbzr-zx1c-m3ck"},{"vulnerability":"VCID-bg89-tyhn-sfc3"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-h261-uqtv-yfek"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-pczz-39pz-37bb"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-xuaz-p5q4-8beh"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-y8xm-g4zt-b7b5"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"},{"vulnerability":"VCID-zmf4-acz8-s3a2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2"}],"aliases":["CVE-2024-25146","GHSA-mqf8-4cqm-p83x"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-p9am-1rhf-6bh2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47093?format=json","vulnerability_id":"VCID-pczz-39pz-37bb","summary":"Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting\nStored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25603","reference_id":"","reference_type":"","scores":[{"value":"0.00152","scoring_system":"epss","scoring_elements":"0.35713","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00152","scoring_system":"epss","scoring_elements":"0.35702","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25603"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25603","reference_id":"CVE-2024-25603","reference_type":"","scores":[{"value":"9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-08-15T15:56:27Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25603"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25603","reference_id":"CVE-2024-25603","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25603"},{"reference_url":"https://github.com/advisories/GHSA-44jg-jgjx-3xg5","reference_id":"GHSA-44jg-jgjx-3xg5","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-44jg-jgjx-3xg5"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69097?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5"}],"aliases":["CVE-2024-25603","GHSA-44jg-jgjx-3xg5"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-pczz-39pz-37bb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/45252?format=json","vulnerability_id":"VCID-pdbx-p4mr-97h4","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\nSQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the application to be upgraded.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33945","reference_id":"","reference_type":"","scores":[{"value":"0.00651","scoring_system":"epss","scoring_elements":"0.713","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00651","scoring_system":"epss","scoring_elements":"0.71293","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33945"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33945","reference_id":"CVE-2023-33945","reference_type":"","scores":[{"value":"6.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:49:11Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33945"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33945","reference_id":"CVE-2023-33945","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33945"},{"reference_url":"https://github.com/advisories/GHSA-g7vw-43xg-8m4h","reference_id":"GHSA-g7vw-43xg-8m4h","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-g7vw-43xg-8m4h"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65207?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.18","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ej5y-geq1-pkfn"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.18"}],"aliases":["CVE-2023-33945","GHSA-g7vw-43xg-8m4h"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-pdbx-p4mr-97h4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47906?format=json","vulnerability_id":"VCID-pf71-p73a-xyda","summary":"Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet\nPossible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to access arbitrary CSS and JSS files and load the files multiple times via the query string in a URL.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43813","reference_id":"","reference_type":"","scores":[{"value":"0.00198","scoring_system":"epss","scoring_elements":"0.41876","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00198","scoring_system":"epss","scoring_elements":"0.41865","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43813"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/7acad68976e831a0f3b855752ad7874e03be1d43","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/7acad68976e831a0f3b855752ad7874e03be1d43"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9159075ede8a1656bf67a893a486c93a9e9fe70a","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9159075ede8a1656bf67a893a486c93a9e9fe70a"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9be57d358ae0f6181a138ce08f52b80e4b14778a","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9be57d358ae0f6181a138ce08f52b80e4b14778a"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-17865","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-17865"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43813","reference_id":"CVE-2025-43813","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-09-30T14:45:14Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43813"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43813","reference_id":"CVE-2025-43813","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43813"},{"reference_url":"https://github.com/advisories/GHSA-2hm7-r8f3-423h","reference_id":"GHSA-2hm7-r8f3-423h","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-2hm7-r8f3-423h"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/70677?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108-ga108","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108-ga108"},{"url":"http://public2.vulnerablecode.io/api/packages/69927?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-su57-hncy-5qg4"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112"}],"aliases":["CVE-2025-43813","GHSA-2hm7-r8f3-423h"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-pf71-p73a-xyda"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47086?format=json","vulnerability_id":"VCID-qks2-mqk8-wffq","summary":"Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting\nCross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26269","reference_id":"","reference_type":"","scores":[{"value":"0.00147","scoring_system":"epss","scoring_elements":"0.34843","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00147","scoring_system":"epss","scoring_elements":"0.34827","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26269"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26269","reference_id":"CVE-2024-26269","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-21T16:16:54Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26269"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26269","reference_id":"CVE-2024-26269","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26269"},{"reference_url":"https://github.com/advisories/GHSA-rwhv-hvj2-qrqm","reference_id":"GHSA-rwhv-hvj2-qrqm","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rwhv-hvj2-qrqm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69086?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.38","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-3hm3-htje-akgd"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dvp1-5vf5-qfg9"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ej5y-geq1-pkfn"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.38"}],"aliases":["CVE-2024-26269","GHSA-rwhv-hvj2-qrqm"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-qks2-mqk8-wffq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/45263?format=json","vulnerability_id":"VCID-qrgm-94me-83hz","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33940","reference_id":"","reference_type":"","scores":[{"value":"0.00259","scoring_system":"epss","scoring_elements":"0.49564","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00259","scoring_system":"epss","scoring_elements":"0.49574","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33940"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940","reference_id":"CVE-2023-33940","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-22T15:45:34Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33940","reference_id":"CVE-2023-33940","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33940"},{"reference_url":"https://github.com/advisories/GHSA-x82q-mr23-27jc","reference_id":"GHSA-x82q-mr23-27jc","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-x82q-mr23-27jc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65224?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.31","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dvp1-5vf5-qfg9"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ej5y-geq1-pkfn"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.31"}],"aliases":["CVE-2023-33940","GHSA-x82q-mr23-27jc"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-qrgm-94me-83hz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47965?format=json","vulnerability_id":"VCID-qy5u-7m7g-4ben","summary":"Liferay Portal is vulnerable to XSS through its Commerce Search Result widget\nCross-site Scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Commerce Product's Name text field.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43823","reference_id":"","reference_type":"","scores":[{"value":"0.00031","scoring_system":"epss","scoring_elements":"0.09263","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00031","scoring_system":"epss","scoring_elements":"0.09244","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43823"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43823","reference_id":"CVE-2025-43823","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-08T13:40:14Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43823"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43823","reference_id":"CVE-2025-43823","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43823"},{"reference_url":"https://github.com/advisories/GHSA-xx7h-2wf7-hc7p","reference_id":"GHSA-xx7h-2wf7-hc7p","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xx7h-2wf7-hc7p"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/70671?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112"}],"aliases":["CVE-2025-43823","GHSA-xx7h-2wf7-hc7p"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-qy5u-7m7g-4ben"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/48302?format=json","vulnerability_id":"VCID-r363-kggk-k3ds","summary":"Liferay Portal is vulnerable to XSS in the Blogs widget\nCross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted <iframe> injected into a blog entry's “Content” text field.\n\nThe Blogs widget in Liferay DXP does not add the sandbox attribute to <iframe> elements, which allows remote attackers to access the parent page via scripts and links in the frame page.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62265","reference_id":"","reference_type":"","scores":[{"value":"0.00031","scoring_system":"epss","scoring_elements":"0.09263","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00031","scoring_system":"epss","scoring_elements":"0.09244","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62265"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62265","reference_id":"CVE-2025-62265","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-30T19:04:40Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62265"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62265","reference_id":"CVE-2025-62265","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62265"},{"reference_url":"https://github.com/advisories/GHSA-56jv-4ww3-65mw","reference_id":"GHSA-56jv-4ww3-65mw","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-56jv-4ww3-65mw"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/70671?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112"}],"aliases":["CVE-2025-62265","GHSA-56jv-4ww3-65mw"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-r363-kggk-k3ds"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47917?format=json","vulnerability_id":"VCID-rns1-e6pd-tkex","summary":"Liferay Portal Vulnerable to XSS in Web Content translation\nStored Cross-site Scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allow remote attackers to inject arbitrary web script or HTML via any rich text field in a web content article.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43826","reference_id":"","reference_type":"","scores":[{"value":"0.00033","scoring_system":"epss","scoring_elements":"0.10198","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00033","scoring_system":"epss","scoring_elements":"0.10177","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43826"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-17939","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-17939"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43826","reference_id":"CVE-2025-43826","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-01T15:03:14Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43826"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43826","reference_id":"CVE-2025-43826","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43826"},{"reference_url":"https://github.com/advisories/GHSA-qh92-cr5f-3595","reference_id":"GHSA-qh92-cr5f-3595","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qh92-cr5f-3595"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/70693?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.113-ga113","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.113-ga113"},{"url":"http://public2.vulnerablecode.io/api/packages/71302?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120"}],"aliases":["CVE-2025-43826","GHSA-qh92-cr5f-3595"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rns1-e6pd-tkex"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/56877?format=json","vulnerability_id":"VCID-sw28-urg9-tqgd","summary":"Liferay Portal and Liferay DXP Reveals Data via Forms\nThe data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 allows an unauthorized user to obtain entry data from forms.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-2565","reference_id":"","reference_type":"","scores":[{"value":"0.00356","scoring_system":"epss","scoring_elements":"0.5821","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00356","scoring_system":"epss","scoring_elements":"0.58201","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-2565"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2025-2565","reference_id":"CVE-2025-2565","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-20T17:53:33Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2025-2565"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2565","reference_id":"CVE-2025-2565","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2565"},{"reference_url":"https://github.com/advisories/GHSA-9fcg-wrp8-qhr4","reference_id":"GHSA-9fcg-wrp8-qhr4","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-9fcg-wrp8-qhr4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/84452?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.129","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-u1pr-9cpx-q3hg"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.129"}],"aliases":["CVE-2025-2565","GHSA-9fcg-wrp8-qhr4"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-sw28-urg9-tqgd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/48157?format=json","vulnerability_id":"VCID-tf5n-etq9-2bg1","summary":"Liferay Portal Does Not Limit Access to APIs Before Email Verification\nLiferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified their email address, which allows remote users to access and edit content via the API.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62259","reference_id":"","reference_type":"","scores":[{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.18117","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.18115","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62259"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62259","reference_id":"CVE-2025-62259","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-28T19:47:44Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62259"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62259","reference_id":"CVE-2025-62259","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62259"},{"reference_url":"https://github.com/advisories/GHSA-gv7w-jh8g-vr73","reference_id":"GHSA-gv7w-jh8g-vr73","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gv7w-jh8g-vr73"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/71160?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110"},{"url":"http://public2.vulnerablecode.io/api/packages/69927?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-su57-hncy-5qg4"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112"}],"aliases":["CVE-2025-62259","GHSA-gv7w-jh8g-vr73"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-tf5n-etq9-2bg1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/56045?format=json","vulnerability_id":"VCID-turp-jxv8-1fgy","summary":"Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console\nThe Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability. This issue has been patched in Liferay Portal 7.4.3.102, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.0, Liferay DXP 2023.Q3.5, and Liferay DXP 7.3 Update 36.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-8980","reference_id":"","reference_type":"","scores":[{"value":"0.00381","scoring_system":"epss","scoring_elements":"0.59889","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00381","scoring_system":"epss","scoring_elements":"0.59892","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-8980"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980","reference_id":"CVE-2024-8980","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:02:17Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8980","reference_id":"CVE-2024-8980","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8980"},{"reference_url":"https://github.com/advisories/GHSA-chj2-4vg7-hhg3","reference_id":"GHSA-chj2-4vg7-hhg3","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-chj2-4vg7-hhg3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/83034?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.102-GA102","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.102-GA102"},{"url":"http://public2.vulnerablecode.io/api/packages/718353?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-3hm3-htje-akgd"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-rs2y-3c75-uycm"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-su57-hncy-5qg4"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103"}],"aliases":["CVE-2024-8980","GHSA-chj2-4vg7-hhg3"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-turp-jxv8-1fgy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47072?format=json","vulnerability_id":"VCID-vez2-knrw-ubbe","summary":"Privilege escalation in Liferay Portal\nLiferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become the owner of a wiki page by editing the wiki page.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-45320","reference_id":"","reference_type":"","scores":[{"value":"0.00362","scoring_system":"epss","scoring_elements":"0.58572","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00362","scoring_system":"epss","scoring_elements":"0.58625","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00362","scoring_system":"epss","scoring_elements":"0.58618","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-45320"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/releases/tag/7.4.3.16-ga16","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/releases/tag/7.4.3.16-ga16"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-45320","reference_id":"CVE-2022-45320","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T15:24:47Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-45320"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45320","reference_id":"CVE-2022-45320","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45320"},{"reference_url":"https://github.com/advisories/GHSA-mc8m-4r3w-q2hw","reference_id":"GHSA-mc8m-4r3w-q2hw","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mc8m-4r3w-q2hw"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69051?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.16","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.16"}],"aliases":["CVE-2022-45320","GHSA-mc8m-4r3w-q2hw"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vez2-knrw-ubbe"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57914?format=json","vulnerability_id":"VCID-w7z4-h1ug-z3cq","summary":"Liferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition Parameter\nA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43757","reference_id":"","reference_type":"","scores":[{"value":"0.00041","scoring_system":"epss","scoring_elements":"0.1269","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00041","scoring_system":"epss","scoring_elements":"0.12686","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43757"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/0114bb60238e5ac74b90fba37fa9748c4e6c114a","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/0114bb60238e5ac74b90fba37fa9748c4e6c114a"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/0837982b91c5f9e837ec11a93f7e0986e00738fa","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/0837982b91c5f9e837ec11a93f7e0986e00738fa"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/45492d30bad4084f36e87ef11c29a5bf5fb4046d","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/45492d30bad4084f36e87ef11c29a5bf5fb4046d"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/90396a201d05be5840f99f7487578aab253dfa87","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/90396a201d05be5840f99f7487578aab253dfa87"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/9e0026c8aa444937a2bfd079bcca35ab3dd18f5a","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/9e0026c8aa444937a2bfd079bcca35ab3dd18f5a"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/cc46176ba4142f470d540f2343b36f12a678a240","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/cc46176ba4142f470d540f2343b36f12a678a240"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/d001c5ba8a1477755d7d83b8a00aba23036b045b","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/d001c5ba8a1477755d7d83b8a00aba23036b045b"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/e83d102bf00af3aa4396c1fc5a1d6b3842ccaeb1","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/e83d102bf00af3aa4396c1fc5a1d6b3842ccaeb1"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18259","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18259"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43757","reference_id":"CVE-2025-43757","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T20:00:20Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43757"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43757","reference_id":"CVE-2025-43757","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43757"},{"reference_url":"https://github.com/advisories/GHSA-62pf-hcwj-rcfc","reference_id":"GHSA-62pf-hcwj-rcfc","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-62pf-hcwj-rcfc"}],"fixed_packages":[],"aliases":["CVE-2025-43757","GHSA-62pf-hcwj-rcfc"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-w7z4-h1ug-z3cq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57901?format=json","vulnerability_id":"VCID-wpqk-8fd9-p3ex","summary":"Liferay Portal Unauthenticated File Access via URL\nLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded in the form and stored in document_library.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43749","reference_id":"","reference_type":"","scores":[{"value":"0.0013","scoring_system":"epss","scoring_elements":"0.32039","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00141","scoring_system":"epss","scoring_elements":"0.34026","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-43749"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/5919534a979a97444172f49705b7a224e372e625","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/5919534a979a97444172f49705b7a224e372e625"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/b88e7e0912d27cc166fc788b642616ece9e8c484","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/b88e7e0912d27cc166fc788b642616ece9e8c484"},{"reference_url":"https://liferay.atlassian.net/browse/LPE-18176","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.atlassian.net/browse/LPE-18176"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43749","reference_id":"CVE-2025-43749","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T15:12:36Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43749"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43749","reference_id":"CVE-2025-43749","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43749"},{"reference_url":"https://github.com/advisories/GHSA-5fx5-cff6-f3fp","reference_id":"GHSA-5fx5-cff6-f3fp","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-5fx5-cff6-f3fp"}],"fixed_packages":[],"aliases":["CVE-2025-43749","GHSA-5fx5-cff6-f3fp"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-wpqk-8fd9-p3ex"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47082?format=json","vulnerability_id":"VCID-xn1n-5rgc-83bg","summary":"Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting\nReflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_roles_admin_web_portlet_RolesAdminPortlet_tabs2` parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-42496","reference_id":"","reference_type":"","scores":[{"value":"0.0044","scoring_system":"epss","scoring_elements":"0.63563","published_at":"2026-06-06T12:55:00Z"},{"value":"0.0044","scoring_system":"epss","scoring_elements":"0.63556","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-42496"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42496","reference_id":"CVE-2023-42496","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T16:07:22Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42496"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42496","reference_id":"CVE-2023-42496","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42496"},{"reference_url":"https://github.com/advisories/GHSA-54pv-r62j-9qqc","reference_id":"GHSA-54pv-r62j-9qqc","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-54pv-r62j-9qqc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69080?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-3hm3-htje-akgd"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-ej5y-geq1-pkfn"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mbd8-z3ry-cqap"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-rs2y-3c75-uycm"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-su57-hncy-5qg4"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-xv4h-g41b-c7c7"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98"}],"aliases":["CVE-2023-42496","GHSA-54pv-r62j-9qqc"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xn1n-5rgc-83bg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47088?format=json","vulnerability_id":"VCID-xuaz-p5q4-8beh","summary":"Liferay Portal Calendar module and Liferay DXP vulnerable to Cross-site Scripting, content spoofing\nThe Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user's name. This may lead to a content spoofing or cross-site scripting (XSS) attacks depending on the capability of the receiver's mail client.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25151","reference_id":"","reference_type":"","scores":[{"value":"0.00426","scoring_system":"epss","scoring_elements":"0.62626","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00426","scoring_system":"epss","scoring_elements":"0.62617","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-25151"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25151","reference_id":"CVE-2024-25151","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T19:59:16Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25151"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25151","reference_id":"CVE-2024-25151","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25151"},{"reference_url":"https://github.com/advisories/GHSA-hgr6-6hhw-883f","reference_id":"GHSA-hgr6-6hhw-883f","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hgr6-6hhw-883f"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65212?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-266t-4gfq-duh4"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-37ph-hjq9-bufq"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-afe9-yqy2-8bdb"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-bbzr-zx1c-m3ck"},{"vulnerability":"VCID-bg89-tyhn-sfc3"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pczz-39pz-37bb"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"},{"vulnerability":"VCID-zmf4-acz8-s3a2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4"}],"aliases":["CVE-2024-25151","GHSA-hgr6-6hhw-883f"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xuaz-p5q4-8beh"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/48307?format=json","vulnerability_id":"VCID-y1wd-arvg-2ugt","summary":"Liferay Portal is vulnerable to DNS rebinding attacks\nBy default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated by changing the redirect URL security from IP to domain.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62266","reference_id":"","reference_type":"","scores":[{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13605","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.136","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62266"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62256","reference_id":"CVE-2025-62256","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-30T19:06:36Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62256"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257","reference_id":"CVE-2025-62257","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62266","reference_id":"CVE-2025-62266","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62266"},{"reference_url":"https://github.com/advisories/GHSA-f5vh-4rj2-w8r8","reference_id":"GHSA-f5vh-4rj2-w8r8","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-f5vh-4rj2-w8r8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/71160?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110"},{"url":"http://public2.vulnerablecode.io/api/packages/69927?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-brjh-tyur-ebc8"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-csnj-331s-43ea"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-su57-hncy-5qg4"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-ynk1-3fye-bfcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112"}],"aliases":["CVE-2025-62266","GHSA-f5vh-4rj2-w8r8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-y1wd-arvg-2ugt"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/110294?format=json","vulnerability_id":"VCID-y8xm-g4zt-b7b5","summary":"Improper Certificate Validation in Liferay Portal\nCertain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3.","references":[{"reference_url":"http://liferay.com","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:21:43Z/"}],"url":"http://liferay.com"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42131","reference_id":"","reference_type":"","scores":[{"value":"0.0013","scoring_system":"epss","scoring_elements":"0.31986","published_at":"2026-06-06T12:55:00Z"},{"value":"0.0013","scoring_system":"epss","scoring_elements":"0.31944","published_at":"2026-06-04T12:55:00Z"},{"value":"0.0013","scoring_system":"epss","scoring_elements":"0.32017","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42131"},{"reference_url":"https://issues.liferay.com/browse/LPE-17377","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:21:43Z/"}],"url":"https://issues.liferay.com/browse/LPE-17377"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42131","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42131"},{"reference_url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42131","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:21:43Z/"}],"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42131"},{"reference_url":"https://github.com/advisories/GHSA-cx84-43xc-3gm2","reference_id":"GHSA-cx84-43xc-3gm2","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-cx84-43xc-3gm2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65212?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-266t-4gfq-duh4"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-37ph-hjq9-bufq"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-afe9-yqy2-8bdb"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-bbzr-zx1c-m3ck"},{"vulnerability":"VCID-bg89-tyhn-sfc3"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pczz-39pz-37bb"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"},{"vulnerability":"VCID-zmf4-acz8-s3a2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4"}],"aliases":["CVE-2022-42131","GHSA-cx84-43xc-3gm2"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-y8xm-g4zt-b7b5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/47085?format=json","vulnerability_id":"VCID-ydhb-8z5m-v7fb","summary":"Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting\nMultiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before update 10, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the first/middle/last name text field of the user who creates an entry in the (1) Announcement widget, or (2) Alerts widget.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26266","reference_id":"","reference_type":"","scores":[{"value":"0.00152","scoring_system":"epss","scoring_elements":"0.35713","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00152","scoring_system":"epss","scoring_elements":"0.35702","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-26266"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26266","reference_id":"CVE-2024-26266","reference_type":"","scores":[{"value":"9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-22T16:43:41Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26266"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26266","reference_id":"CVE-2024-26266","reference_type":"","scores":[{"value":"9.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26266"},{"reference_url":"https://github.com/advisories/GHSA-rwxc-4cmw-7x75","reference_id":"GHSA-rwxc-4cmw-7x75","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rwxc-4cmw-7x75"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69017?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-5nq8-gsav-5ffq"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-d56y-s4zt-uyd7"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14"}],"aliases":["CVE-2024-26266","GHSA-rwxc-4cmw-7x75"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ydhb-8z5m-v7fb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/110338?format=json","vulnerability_id":"VCID-zmf4-acz8-s3a2","summary":"Incorrect Default Permissions in Liferay Portal\nThe Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.","references":[{"reference_url":"http://liferay.com","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T18:26:36Z/"}],"url":"http://liferay.com"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42130","reference_id":"","reference_type":"","scores":[{"value":"0.00191","scoring_system":"epss","scoring_elements":"0.40841","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00191","scoring_system":"epss","scoring_elements":"0.40759","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00191","scoring_system":"epss","scoring_elements":"0.40837","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42130"},{"reference_url":"https://issues.liferay.com/browse/LPE-17447","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T18:26:36Z/"}],"url":"https://issues.liferay.com/browse/LPE-17447"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42130","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42130"},{"reference_url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42130","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T18:26:36Z/"}],"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42130"},{"reference_url":"https://github.com/advisories/GHSA-mxvq-cv4x-p3jw","reference_id":"GHSA-mxvq-cv4x-p3jw","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mxvq-cv4x-p3jw"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/69097?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-11qf-d5xp-4fey"},{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-mgw3-28sj-juh7"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-patg-tmcj-3qbh"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-s86p-ew9a-rkgt"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-v633-mycj-6uh6"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-wzj5-ba9k-q3at"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5"}],"aliases":["CVE-2022-42130","GHSA-mxvq-cv4x-p3jw"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zmf4-acz8-s3a2"}],"fixing_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/45255?format=json","vulnerability_id":"VCID-b1cb-4tud-jked","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object's `Name` field.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33938","reference_id":"","reference_type":"","scores":[{"value":"0.00304","scoring_system":"epss","scoring_elements":"0.5399","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00304","scoring_system":"epss","scoring_elements":"0.53997","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-33938"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33938","reference_id":"CVE-2023-33938","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-22T15:46:09Z/"}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33938"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33938","reference_id":"CVE-2023-33938","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33938"},{"reference_url":"https://github.com/advisories/GHSA-wvhw-5m89-64gv","reference_id":"GHSA-wvhw-5m89-64gv","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-wvhw-5m89-64gv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65211?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-266t-4gfq-duh4"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2fn6-apud-qbh4"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-37ph-hjq9-bufq"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4mcy-yw2p-v7bd"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8jv6-163j-a7b2"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-afe9-yqy2-8bdb"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-b7h9-cxkj-hkc8"},{"vulnerability":"VCID-bbzr-zx1c-m3ck"},{"vulnerability":"VCID-bg89-tyhn-sfc3"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-h261-uqtv-yfek"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hrnu-4t2j-9qba"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-hw1d-gdcv-vkec"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-p9am-1rhf-6bh2"},{"vulnerability":"VCID-pczz-39pz-37bb"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-xuaz-p5q4-8beh"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-y8xm-g4zt-b7b5"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"},{"vulnerability":"VCID-zmf4-acz8-s3a2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.1"}],"aliases":["CVE-2023-33938","GHSA-wvhw-5m89-64gv"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-b1cb-4tud-jked"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/111100?format=json","vulnerability_id":"VCID-decd-p71w-dbe4","summary":"Liferay Portal cross-site scripting (XSS) vulnerability in the Frontend Taglib module\nCross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-35463","reference_id":"","reference_type":"","scores":[{"value":"0.00149","scoring_system":"epss","scoring_elements":"0.35097","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00149","scoring_system":"epss","scoring_elements":"0.35208","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00149","scoring_system":"epss","scoring_elements":"0.35192","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-35463"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://github.com/liferay/liferay-portal/commit/751a70e0ed7b380ea2ab510ff79ddb33ed87dd9b","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal/commit/751a70e0ed7b380ea2ab510ff79ddb33ed87dd9b"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-35463-reflected-xss-with-keywords-in-search?p_r_p_assetEntryId=121611661&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611661%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-35463-reflected-xss-with-keywords-in-search?p_r_p_assetEntryId=121611661&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611661%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35463","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35463"},{"reference_url":"https://github.com/advisories/GHSA-9h7f-5hc8-cj5f","reference_id":"GHSA-9h7f-5hc8-cj5f","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-9h7f-5hc8-cj5f"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65211?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-266t-4gfq-duh4"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2fn6-apud-qbh4"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-37ph-hjq9-bufq"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4mcy-yw2p-v7bd"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8jv6-163j-a7b2"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-afe9-yqy2-8bdb"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-b7h9-cxkj-hkc8"},{"vulnerability":"VCID-bbzr-zx1c-m3ck"},{"vulnerability":"VCID-bg89-tyhn-sfc3"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-h261-uqtv-yfek"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hrnu-4t2j-9qba"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-hw1d-gdcv-vkec"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-p9am-1rhf-6bh2"},{"vulnerability":"VCID-pczz-39pz-37bb"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-xuaz-p5q4-8beh"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-y8xm-g4zt-b7b5"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"},{"vulnerability":"VCID-zmf4-acz8-s3a2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.1"}],"aliases":["CVE-2021-35463","GHSA-9h7f-5hc8-cj5f"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-decd-p71w-dbe4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/110105?format=json","vulnerability_id":"VCID-j127-h1mf-nqam","summary":"Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module\nA SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.","references":[{"reference_url":"http://liferay.com","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-30T14:59:30Z/"}],"url":"http://liferay.com"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42122","reference_id":"","reference_type":"","scores":[{"value":"0.00815","scoring_system":"epss","scoring_elements":"0.74675","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00815","scoring_system":"epss","scoring_elements":"0.74644","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00815","scoring_system":"epss","scoring_elements":"0.74681","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-42122"},{"reference_url":"https://github.com/liferay/liferay-portal","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/liferay/liferay-portal"},{"reference_url":"https://issues.liferay.com/browse/LPE-17520","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-30T14:59:30Z/"}],"url":"https://issues.liferay.com/browse/LPE-17520"},{"reference_url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42122?p_r_p_assetEntryId=121613466&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613466%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42122?p_r_p_assetEntryId=121613466&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613466%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42122","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42122"},{"reference_url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-30T14:59:30Z/"}],"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122"},{"reference_url":"https://web.archive.org/web/20221115051621/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20221115051621/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122"},{"reference_url":"https://github.com/advisories/GHSA-hw56-7xj4-7gx6","reference_id":"GHSA-hw56-7xj4-7gx6","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hw56-7xj4-7gx6"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/70676?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.0-ga1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-y1wd-arvg-2ugt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.0-ga1"},{"url":"http://public2.vulnerablecode.io/api/packages/65211?format=json","purl":"pkg:maven/com.liferay.portal/release.portal.bom@7.4.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1fqz-psdf-g7dm"},{"vulnerability":"VCID-1jgz-k7zp-uydp"},{"vulnerability":"VCID-266t-4gfq-duh4"},{"vulnerability":"VCID-27a1-teqk-cbe2"},{"vulnerability":"VCID-292m-hgvs-93ey"},{"vulnerability":"VCID-298n-mh47-3ygq"},{"vulnerability":"VCID-2bcr-bxek-skfq"},{"vulnerability":"VCID-2dra-x6f5-xybz"},{"vulnerability":"VCID-2fn6-apud-qbh4"},{"vulnerability":"VCID-2mtb-mdha-qufv"},{"vulnerability":"VCID-37ph-hjq9-bufq"},{"vulnerability":"VCID-38vz-usgx-g7dv"},{"vulnerability":"VCID-434b-p73k-5fam"},{"vulnerability":"VCID-4611-azkf-sffv"},{"vulnerability":"VCID-4kym-jhtn-cfa3"},{"vulnerability":"VCID-4mcy-yw2p-v7bd"},{"vulnerability":"VCID-4xqq-69ab-1qew"},{"vulnerability":"VCID-5732-ffyz-9fh5"},{"vulnerability":"VCID-5bex-xcub-3qhr"},{"vulnerability":"VCID-68yp-31d3-zbay"},{"vulnerability":"VCID-6yrk-8tj5-juhp"},{"vulnerability":"VCID-7tas-6nn4-9fhu"},{"vulnerability":"VCID-8jv6-163j-a7b2"},{"vulnerability":"VCID-8xx2-vtnr-dubu"},{"vulnerability":"VCID-9471-umbz-pucy"},{"vulnerability":"VCID-9yw4-52sc-rbbz"},{"vulnerability":"VCID-a7z8-2fzy-2qee"},{"vulnerability":"VCID-afe9-yqy2-8bdb"},{"vulnerability":"VCID-b24q-c9nx-hkdy"},{"vulnerability":"VCID-b7h9-cxkj-hkc8"},{"vulnerability":"VCID-bbzr-zx1c-m3ck"},{"vulnerability":"VCID-bg89-tyhn-sfc3"},{"vulnerability":"VCID-by7b-2zr9-y3dj"},{"vulnerability":"VCID-ca62-h2qv-v7bg"},{"vulnerability":"VCID-ce9p-rwsz-zkf6"},{"vulnerability":"VCID-cj4m-mvzh-ckh4"},{"vulnerability":"VCID-dt2w-w4vw-1yhe"},{"vulnerability":"VCID-e5c7-wsvb-dyfm"},{"vulnerability":"VCID-e5h2-wvws-3yhq"},{"vulnerability":"VCID-ebzh-bpks-5qe2"},{"vulnerability":"VCID-evap-nt9g-akf6"},{"vulnerability":"VCID-g41m-xvk2-xfda"},{"vulnerability":"VCID-gaqh-vn1h-b3c1"},{"vulnerability":"VCID-ggmh-6ef8-7ufj"},{"vulnerability":"VCID-ggs5-4zac-vqa7"},{"vulnerability":"VCID-gyge-7d5c-6uhz"},{"vulnerability":"VCID-h261-uqtv-yfek"},{"vulnerability":"VCID-hhmu-vsj9-gudx"},{"vulnerability":"VCID-hrnu-4t2j-9qba"},{"vulnerability":"VCID-hvpx-y297-sbha"},{"vulnerability":"VCID-hw1d-gdcv-vkec"},{"vulnerability":"VCID-j3pc-gwg6-qfbs"},{"vulnerability":"VCID-k1u8-ur3y-zucd"},{"vulnerability":"VCID-k9yt-aj7x-3bht"},{"vulnerability":"VCID-kjbx-n3pd-yba9"},{"vulnerability":"VCID-ksvn-b6hv-hfa7"},{"vulnerability":"VCID-mcea-q7za-duay"},{"vulnerability":"VCID-msd2-mccp-z7cv"},{"vulnerability":"VCID-nhp5-61h7-ryf4"},{"vulnerability":"VCID-p9am-1rhf-6bh2"},{"vulnerability":"VCID-pczz-39pz-37bb"},{"vulnerability":"VCID-pdbx-p4mr-97h4"},{"vulnerability":"VCID-pf71-p73a-xyda"},{"vulnerability":"VCID-qks2-mqk8-wffq"},{"vulnerability":"VCID-qrgm-94me-83hz"},{"vulnerability":"VCID-qy5u-7m7g-4ben"},{"vulnerability":"VCID-r363-kggk-k3ds"},{"vulnerability":"VCID-rns1-e6pd-tkex"},{"vulnerability":"VCID-sw28-urg9-tqgd"},{"vulnerability":"VCID-tf5n-etq9-2bg1"},{"vulnerability":"VCID-turp-jxv8-1fgy"},{"vulnerability":"VCID-vez2-knrw-ubbe"},{"vulnerability":"VCID-w7z4-h1ug-z3cq"},{"vulnerability":"VCID-wpqk-8fd9-p3ex"},{"vulnerability":"VCID-xn1n-5rgc-83bg"},{"vulnerability":"VCID-xuaz-p5q4-8beh"},{"vulnerability":"VCID-y1wd-arvg-2ugt"},{"vulnerability":"VCID-y8xm-g4zt-b7b5"},{"vulnerability":"VCID-ydhb-8z5m-v7fb"},{"vulnerability":"VCID-zmf4-acz8-s3a2"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.1"}],"aliases":["CVE-2022-42122","GHSA-hw56-7xj4-7gx6"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-j127-h1mf-nqam"}],"risk_score":"4.5","resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.1"}