Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27
Typemaven
Namespacecom.liferay.portal
Namerelease.portal.bom
Version7.4.3.27
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_versionnull
Latest_non_vulnerable_versionnull
Affected_by_vulnerabilities
0
url VCID-11qf-d5xp-4fey
vulnerability_id VCID-11qf-d5xp-4fey
summary 
Liferay Portal vulnerable to cross-site scripting in the web content template
Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a web content structure's Name text field
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43812
reference_id
reference_type
scores
0
value 0.00033
scoring_system epss
scoring_elements 0.10198
published_at 2026-06-06T12:55:00Z
1
value 0.00033
scoring_system epss
scoring_elements 0.10177
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43812
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/7466c9ba0126a4a93c85913cbec9b11c687deb36
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/7466c9ba0126a4a93c85913cbec9b11c687deb36
3
reference_url https://liferay.atlassian.net/browse/LPE-17942
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-17942
4
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43812
reference_id CVE-2025-43812
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-30T14:45:45Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43812
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43812
reference_id CVE-2025-43812
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43812
6
reference_url https://github.com/advisories/GHSA-jv8x-mm3v-75r7
reference_id GHSA-jv8x-mm3v-75r7
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-jv8x-mm3v-75r7
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-27a1-teqk-cbe2
1
vulnerability VCID-2bcr-bxek-skfq
2
vulnerability VCID-2dra-x6f5-xybz
3
vulnerability VCID-2mtb-mdha-qufv
4
vulnerability VCID-434b-p73k-5fam
5
vulnerability VCID-4kym-jhtn-cfa3
6
vulnerability VCID-4xqq-69ab-1qew
7
vulnerability VCID-8xx2-vtnr-dubu
8
vulnerability VCID-brjh-tyur-ebc8
9
vulnerability VCID-by7b-2zr9-y3dj
10
vulnerability VCID-ca62-h2qv-v7bg
11
vulnerability VCID-csnj-331s-43ea
12
vulnerability VCID-ebzh-bpks-5qe2
13
vulnerability VCID-evap-nt9g-akf6
14
vulnerability VCID-g41m-xvk2-xfda
15
vulnerability VCID-ggmh-6ef8-7ufj
16
vulnerability VCID-gyge-7d5c-6uhz
17
vulnerability VCID-j3pc-gwg6-qfbs
18
vulnerability VCID-ksvn-b6hv-hfa7
19
vulnerability VCID-nhp5-61h7-ryf4
20
vulnerability VCID-rns1-e6pd-tkex
21
vulnerability VCID-s86p-ew9a-rkgt
22
vulnerability VCID-sw28-urg9-tqgd
23
vulnerability VCID-w7z4-h1ug-z3cq
24
vulnerability VCID-wpqk-8fd9-p3ex
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
aliases CVE-2025-43812, GHSA-jv8x-mm3v-75r7
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-11qf-d5xp-4fey
1
url VCID-1fqz-psdf-g7dm
vulnerability_id VCID-1fqz-psdf-g7dm
summary 
Liferay Portal and Liferay DXP User Enumeration Vulnerability
User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request's response time.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-26268
reference_id
reference_type
scores
0
value 0.00304
scoring_system epss
scoring_elements 0.54034
published_at 2026-06-06T12:55:00Z
1
value 0.00304
scoring_system epss
scoring_elements 0.54027
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-26268
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/46db55ec21103fa39542e2cba080c4f98e3c5f93
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/46db55ec21103fa39542e2cba080c4f98e3c5f93
3
reference_url https://github.com/liferay/liferay-portal/commit/d8d0ae0178a2d902b541c80a230a2c7a5ab246e8
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/d8d0ae0178a2d902b541c80a230a2c7a5ab246e8
4
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26268
reference_id CVE-2024-26268
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-20T16:17:11Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26268
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-26268
reference_id CVE-2024-26268
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-26268
6
reference_url https://github.com/advisories/GHSA-qm43-g2xj-hvg5
reference_id GHSA-qm43-g2xj-hvg5
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-qm43-g2xj-hvg5
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27-ga27
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27-ga27
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27-ga27
1
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.28
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.28
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-292m-hgvs-93ey
4
vulnerability VCID-2bcr-bxek-skfq
5
vulnerability VCID-2dra-x6f5-xybz
6
vulnerability VCID-2mtb-mdha-qufv
7
vulnerability VCID-434b-p73k-5fam
8
vulnerability VCID-4kym-jhtn-cfa3
9
vulnerability VCID-4xqq-69ab-1qew
10
vulnerability VCID-5732-ffyz-9fh5
11
vulnerability VCID-5bex-xcub-3qhr
12
vulnerability VCID-5nq8-gsav-5ffq
13
vulnerability VCID-68yp-31d3-zbay
14
vulnerability VCID-6yrk-8tj5-juhp
15
vulnerability VCID-7tas-6nn4-9fhu
16
vulnerability VCID-8xx2-vtnr-dubu
17
vulnerability VCID-b24q-c9nx-hkdy
18
vulnerability VCID-by7b-2zr9-y3dj
19
vulnerability VCID-ca62-h2qv-v7bg
20
vulnerability VCID-ce9p-rwsz-zkf6
21
vulnerability VCID-cj4m-mvzh-ckh4
22
vulnerability VCID-d56y-s4zt-uyd7
23
vulnerability VCID-dvp1-5vf5-qfg9
24
vulnerability VCID-e5h2-wvws-3yhq
25
vulnerability VCID-ebzh-bpks-5qe2
26
vulnerability VCID-ej5y-geq1-pkfn
27
vulnerability VCID-evap-nt9g-akf6
28
vulnerability VCID-g41m-xvk2-xfda
29
vulnerability VCID-gaqh-vn1h-b3c1
30
vulnerability VCID-ggmh-6ef8-7ufj
31
vulnerability VCID-gyge-7d5c-6uhz
32
vulnerability VCID-hvpx-y297-sbha
33
vulnerability VCID-j3pc-gwg6-qfbs
34
vulnerability VCID-ksvn-b6hv-hfa7
35
vulnerability VCID-mgw3-28sj-juh7
36
vulnerability VCID-msd2-mccp-z7cv
37
vulnerability VCID-nhp5-61h7-ryf4
38
vulnerability VCID-patg-tmcj-3qbh
39
vulnerability VCID-pf71-p73a-xyda
40
vulnerability VCID-qks2-mqk8-wffq
41
vulnerability VCID-qrgm-94me-83hz
42
vulnerability VCID-qy5u-7m7g-4ben
43
vulnerability VCID-r363-kggk-k3ds
44
vulnerability VCID-rns1-e6pd-tkex
45
vulnerability VCID-s86p-ew9a-rkgt
46
vulnerability VCID-sw28-urg9-tqgd
47
vulnerability VCID-tf5n-etq9-2bg1
48
vulnerability VCID-turp-jxv8-1fgy
49
vulnerability VCID-v633-mycj-6uh6
50
vulnerability VCID-w7z4-h1ug-z3cq
51
vulnerability VCID-wpqk-8fd9-p3ex
52
vulnerability VCID-wzj5-ba9k-q3at
53
vulnerability VCID-xn1n-5rgc-83bg
54
vulnerability VCID-y1wd-arvg-2ugt
55
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.28
aliases CVE-2024-26268, GHSA-qm43-g2xj-hvg5
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1fqz-psdf-g7dm
2
url VCID-1jgz-k7zp-uydp
vulnerability_id VCID-1jgz-k7zp-uydp
summary 
Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-38002
reference_id
reference_type
scores
0
value 0.04275
scoring_system epss
scoring_elements 0.89044
published_at 2026-06-06T12:55:00Z
1
value 0.04275
scoring_system epss
scoring_elements 0.89043
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-38002
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 9.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-38002
reference_id CVE-2024-38002
reference_type
scores
0
value 9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
1
value 9.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:21:03Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-38002
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-38002
reference_id CVE-2024-38002
reference_type
scores
0
value 9.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-38002
4
reference_url https://github.com/advisories/GHSA-3mfq-fp2f-vwqh
reference_id GHSA-3mfq-fp2f-vwqh
reference_type
scores
url https://github.com/advisories/GHSA-3mfq-fp2f-vwqh
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-27a1-teqk-cbe2
1
vulnerability VCID-2bcr-bxek-skfq
2
vulnerability VCID-2dra-x6f5-xybz
3
vulnerability VCID-2mtb-mdha-qufv
4
vulnerability VCID-434b-p73k-5fam
5
vulnerability VCID-4kym-jhtn-cfa3
6
vulnerability VCID-4xqq-69ab-1qew
7
vulnerability VCID-8xx2-vtnr-dubu
8
vulnerability VCID-brjh-tyur-ebc8
9
vulnerability VCID-by7b-2zr9-y3dj
10
vulnerability VCID-ca62-h2qv-v7bg
11
vulnerability VCID-csnj-331s-43ea
12
vulnerability VCID-ebzh-bpks-5qe2
13
vulnerability VCID-evap-nt9g-akf6
14
vulnerability VCID-g41m-xvk2-xfda
15
vulnerability VCID-ggmh-6ef8-7ufj
16
vulnerability VCID-gyge-7d5c-6uhz
17
vulnerability VCID-j3pc-gwg6-qfbs
18
vulnerability VCID-ksvn-b6hv-hfa7
19
vulnerability VCID-nhp5-61h7-ryf4
20
vulnerability VCID-rns1-e6pd-tkex
21
vulnerability VCID-s86p-ew9a-rkgt
22
vulnerability VCID-sw28-urg9-tqgd
23
vulnerability VCID-w7z4-h1ug-z3cq
24
vulnerability VCID-wpqk-8fd9-p3ex
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
aliases CVE-2024-38002, GHSA-3mfq-fp2f-vwqh
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1jgz-k7zp-uydp
3
url VCID-27a1-teqk-cbe2
vulnerability_id VCID-27a1-teqk-cbe2
summary 
Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting
A stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43776
reference_id
reference_type
scores
0
value 0.00044
scoring_system epss
scoring_elements 0.13928
published_at 2026-06-05T12:55:00Z
1
value 0.00044
scoring_system epss
scoring_elements 0.13932
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43776
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 4.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.atlassian.net/browse/LPE-18277
reference_id
reference_type
scores
0
value 4.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-18277
3
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43776
reference_id CVE-2025-43776
reference_type
scores
0
value 4.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-09T15:04:48Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43776
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43776
reference_id CVE-2025-43776
reference_type
scores
0
value 4.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43776
5
reference_url https://github.com/advisories/GHSA-rcc7-jx7p-hrv4
reference_id GHSA-rcc7-jx7p-hrv4
reference_type
scores
url https://github.com/advisories/GHSA-rcc7-jx7p-hrv4
fixed_packages
aliases CVE-2025-43776, GHSA-rcc7-jx7p-hrv4
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-27a1-teqk-cbe2
4
url VCID-292m-hgvs-93ey
vulnerability_id VCID-292m-hgvs-93ey
summary 
Liferay Portal Vulnerable to DoS via Crafted Headless API Request
Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing a request that returns a large number of objects.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-62260
reference_id
reference_type
scores
0
value 0.00169
scoring_system epss
scoring_elements 0.37912
published_at 2026-06-06T12:55:00Z
1
value 0.00169
scoring_system epss
scoring_elements 0.37909
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-62260
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 7.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/5f5c73913b0e7287f7de0b4e19987cc57844b691
reference_id
reference_type
scores
0
value 7.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/5f5c73913b0e7287f7de0b4e19987cc57844b691
3
reference_url https://liferay.atlassian.net/browse/LPE-17800
reference_id
reference_type
scores
0
value 7.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-17800
4
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62260
reference_id CVE-2025-62260
reference_type
scores
0
value 7.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-28T15:01:15Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62260
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-62260
reference_id CVE-2025-62260
reference_type
scores
0
value 7.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-62260
6
reference_url https://github.com/advisories/GHSA-vgqx-447m-wvcj
reference_id GHSA-vgqx-447m-wvcj
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-vgqx-447m-wvcj
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-2bcr-bxek-skfq
4
vulnerability VCID-2dra-x6f5-xybz
5
vulnerability VCID-2mtb-mdha-qufv
6
vulnerability VCID-3hm3-htje-akgd
7
vulnerability VCID-434b-p73k-5fam
8
vulnerability VCID-4kym-jhtn-cfa3
9
vulnerability VCID-4xqq-69ab-1qew
10
vulnerability VCID-5732-ffyz-9fh5
11
vulnerability VCID-5bex-xcub-3qhr
12
vulnerability VCID-68yp-31d3-zbay
13
vulnerability VCID-6yrk-8tj5-juhp
14
vulnerability VCID-8xx2-vtnr-dubu
15
vulnerability VCID-brjh-tyur-ebc8
16
vulnerability VCID-by7b-2zr9-y3dj
17
vulnerability VCID-ca62-h2qv-v7bg
18
vulnerability VCID-ce9p-rwsz-zkf6
19
vulnerability VCID-csnj-331s-43ea
20
vulnerability VCID-d56y-s4zt-uyd7
21
vulnerability VCID-ebzh-bpks-5qe2
22
vulnerability VCID-ej5y-geq1-pkfn
23
vulnerability VCID-evap-nt9g-akf6
24
vulnerability VCID-g41m-xvk2-xfda
25
vulnerability VCID-ggmh-6ef8-7ufj
26
vulnerability VCID-gyge-7d5c-6uhz
27
vulnerability VCID-hvpx-y297-sbha
28
vulnerability VCID-j3pc-gwg6-qfbs
29
vulnerability VCID-ksvn-b6hv-hfa7
30
vulnerability VCID-mbd8-z3ry-cqap
31
vulnerability VCID-nhp5-61h7-ryf4
32
vulnerability VCID-pf71-p73a-xyda
33
vulnerability VCID-qy5u-7m7g-4ben
34
vulnerability VCID-r363-kggk-k3ds
35
vulnerability VCID-rns1-e6pd-tkex
36
vulnerability VCID-rs2y-3c75-uycm
37
vulnerability VCID-s86p-ew9a-rkgt
38
vulnerability VCID-su57-hncy-5qg4
39
vulnerability VCID-sw28-urg9-tqgd
40
vulnerability VCID-tf5n-etq9-2bg1
41
vulnerability VCID-turp-jxv8-1fgy
42
vulnerability VCID-w7z4-h1ug-z3cq
43
vulnerability VCID-wpqk-8fd9-p3ex
44
vulnerability VCID-y1wd-arvg-2ugt
45
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100
aliases CVE-2025-62260, GHSA-vgqx-447m-wvcj
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-292m-hgvs-93ey
5
url VCID-2bcr-bxek-skfq
vulnerability_id VCID-2bcr-bxek-skfq
summary 
Liferay Portal vulnerable to password enumeration
Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-62257
reference_id
reference_type
scores
0
value 0.00016
scoring_system epss
scoring_elements 0.03992
published_at 2026-06-06T12:55:00Z
1
value 0.00016
scoring_system epss
scoring_elements 0.03995
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-62257
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/45cffd5030ab78e8b005d9cfd6284311da978c68
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/45cffd5030ab78e8b005d9cfd6284311da978c68
3
reference_url https://github.com/liferay/liferay-portal/commit/924a0a47007665693fe2d29623cb48a426a80266
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/924a0a47007665693fe2d29623cb48a426a80266
4
reference_url https://github.com/liferay/liferay-portal/commit/d21627ac07561c5063f611be631e63ff502ec8e7
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/d21627ac07561c5063f611be631e63ff502ec8e7
5
reference_url https://liferay.atlassian.net/browse/LPE-17692
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-17692
6
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257
reference_id CVE-2025-62257
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-30T14:08:10Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-62257
reference_id CVE-2025-62257
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-62257
8
reference_url https://github.com/advisories/GHSA-8hw3-ghwv-crfh
reference_id GHSA-8hw3-ghwv-crfh
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-8hw3-ghwv-crfh
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-27a1-teqk-cbe2
1
vulnerability VCID-2dra-x6f5-xybz
2
vulnerability VCID-2mtb-mdha-qufv
3
vulnerability VCID-434b-p73k-5fam
4
vulnerability VCID-4kym-jhtn-cfa3
5
vulnerability VCID-4xqq-69ab-1qew
6
vulnerability VCID-8xx2-vtnr-dubu
7
vulnerability VCID-brjh-tyur-ebc8
8
vulnerability VCID-by7b-2zr9-y3dj
9
vulnerability VCID-ca62-h2qv-v7bg
10
vulnerability VCID-csnj-331s-43ea
11
vulnerability VCID-ebzh-bpks-5qe2
12
vulnerability VCID-evap-nt9g-akf6
13
vulnerability VCID-g41m-xvk2-xfda
14
vulnerability VCID-ggmh-6ef8-7ufj
15
vulnerability VCID-gyge-7d5c-6uhz
16
vulnerability VCID-j3pc-gwg6-qfbs
17
vulnerability VCID-ksvn-b6hv-hfa7
18
vulnerability VCID-nhp5-61h7-ryf4
19
vulnerability VCID-s86p-ew9a-rkgt
20
vulnerability VCID-sw28-urg9-tqgd
21
vulnerability VCID-w7z4-h1ug-z3cq
22
vulnerability VCID-wpqk-8fd9-p3ex
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120
aliases CVE-2025-62257, GHSA-8hw3-ghwv-crfh
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-2bcr-bxek-skfq
6
url VCID-2dra-x6f5-xybz
vulnerability_id VCID-2dra-x6f5-xybz
summary 
Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect
references
0
reference_url http://github.com/liferay/liferay-portal/commit/58b365ffe2f088b308cfae207474ade3e143bbf9
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://github.com/liferay/liferay-portal/commit/58b365ffe2f088b308cfae207474ade3e143bbf9
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43760
reference_id
reference_type
scores
0
value 0.00048
scoring_system epss
scoring_elements 0.15367
published_at 2026-06-06T12:55:00Z
1
value 0.00048
scoring_system epss
scoring_elements 0.15376
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43760
2
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
3
reference_url https://github.com/liferay/liferay-portal/commit/7a1a7f0359e99be27ca04dab119e867c2263f040
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/7a1a7f0359e99be27ca04dab119e867c2263f040
4
reference_url https://github.com/liferay/liferay-portal/commit/7c742f32f536dadfdbcad68acd20c63363728a25
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/7c742f32f536dadfdbcad68acd20c63363728a25
5
reference_url https://github.com/liferay/liferay-portal/commit/8f5989233fe36261df8e7bb356b1cc833ba4f34e
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/8f5989233fe36261df8e7bb356b1cc833ba4f34e
6
reference_url https://github.com/liferay/liferay-portal/commit/9485d39fa2b66cfc075b16fddaafa9fca64a5687
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/9485d39fa2b66cfc075b16fddaafa9fca64a5687
7
reference_url https://github.com/liferay/liferay-portal/commit/aa88fd90657cd83d92ed2e6fbcbc28e5cf7e3fca
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/aa88fd90657cd83d92ed2e6fbcbc28e5cf7e3fca
8
reference_url https://github.com/liferay/liferay-portal/commit/c457c6d72685db48ed07562a33c67d7998e88b27
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/c457c6d72685db48ed07562a33c67d7998e88b27
9
reference_url https://github.com/liferay/liferay-portal/commit/ddd3a57cd5d3a8891673491b8b6cb680dff1f3c5
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/ddd3a57cd5d3a8891673491b8b6cb680dff1f3c5
10
reference_url https://liferay.atlassian.net/browse/LPE-18156
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-18156
11
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43760
reference_id CVE-2025-43760
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-22T18:00:22Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43760
12
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43760
reference_id CVE-2025-43760
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43760
13
reference_url https://github.com/advisories/GHSA-fvqv-593q-qp8r
reference_id GHSA-fvqv-593q-qp8r
reference_type
scores
url https://github.com/advisories/GHSA-fvqv-593q-qp8r
fixed_packages
aliases CVE-2025-43760, GHSA-fvqv-593q-qp8r
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-2dra-x6f5-xybz
7
url VCID-2mtb-mdha-qufv
vulnerability_id VCID-2mtb-mdha-qufv
summary 
Liferay Portal Vulnerable to Cross-Site Request Forgery
Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43748
reference_id
reference_type
scores
0
value 0.00033
scoring_system epss
scoring_elements 0.10059
published_at 2026-06-05T12:55:00Z
1
value 0.00036
scoring_system epss
scoring_elements 0.11
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43748
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 7.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.atlassian.net/browse/LPE-17839
reference_id
reference_type
scores
0
value 7.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-17839
3
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43748
reference_id CVE-2025-43748
reference_type
scores
0
value 7.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-08-22T03:55:44Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43748
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43748
reference_id CVE-2025-43748
reference_type
scores
0
value 7.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43748
5
reference_url https://github.com/advisories/GHSA-p9gc-59hf-x48p
reference_id GHSA-p9gc-59hf-x48p
reference_type
scores
url https://github.com/advisories/GHSA-p9gc-59hf-x48p
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120-ga120
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120-ga120
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-u1pr-9cpx-q3hg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120-ga120
1
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.125
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.125
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-27a1-teqk-cbe2
1
vulnerability VCID-2dra-x6f5-xybz
2
vulnerability VCID-434b-p73k-5fam
3
vulnerability VCID-4kym-jhtn-cfa3
4
vulnerability VCID-4xqq-69ab-1qew
5
vulnerability VCID-8xx2-vtnr-dubu
6
vulnerability VCID-brjh-tyur-ebc8
7
vulnerability VCID-by7b-2zr9-y3dj
8
vulnerability VCID-ca62-h2qv-v7bg
9
vulnerability VCID-csnj-331s-43ea
10
vulnerability VCID-ebzh-bpks-5qe2
11
vulnerability VCID-evap-nt9g-akf6
12
vulnerability VCID-g41m-xvk2-xfda
13
vulnerability VCID-ggmh-6ef8-7ufj
14
vulnerability VCID-gyge-7d5c-6uhz
15
vulnerability VCID-j3pc-gwg6-qfbs
16
vulnerability VCID-ksvn-b6hv-hfa7
17
vulnerability VCID-nhp5-61h7-ryf4
18
vulnerability VCID-s86p-ew9a-rkgt
19
vulnerability VCID-sw28-urg9-tqgd
20
vulnerability VCID-u1pr-9cpx-q3hg
21
vulnerability VCID-w7z4-h1ug-z3cq
22
vulnerability VCID-wpqk-8fd9-p3ex
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.125
aliases CVE-2025-43748, GHSA-p9gc-59hf-x48p
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-2mtb-mdha-qufv
8
url VCID-434b-p73k-5fam
vulnerability_id VCID-434b-p73k-5fam
summary 
Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_portletNamespace and _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_namespace parameter.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43746
reference_id
reference_type
scores
0
value 0.00041
scoring_system epss
scoring_elements 0.1269
published_at 2026-06-06T12:55:00Z
1
value 0.00041
scoring_system epss
scoring_elements 0.12686
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43746
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/5ca8331da4503ae336818a747e43817066f27b73
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/5ca8331da4503ae336818a747e43817066f27b73
3
reference_url https://github.com/liferay/liferay-portal/commit/7ac0f245435a18e42291186907ad6dbf0e4e8a43
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/7ac0f245435a18e42291186907ad6dbf0e4e8a43
4
reference_url https://github.com/liferay/liferay-portal/commit/c4c34a13094356160474c06c3a115723d97f75ab
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/c4c34a13094356160474c06c3a115723d97f75ab
5
reference_url https://liferay.atlassian.net/browse/LPE-18244
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-18244
6
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43746
reference_id CVE-2025-43746
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T18:53:24Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43746
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43746
reference_id CVE-2025-43746
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43746
8
reference_url https://github.com/advisories/GHSA-mpww-r37c-vxjw
reference_id GHSA-mpww-r37c-vxjw
reference_type
scores
url https://github.com/advisories/GHSA-mpww-r37c-vxjw
fixed_packages
aliases CVE-2025-43746, GHSA-mpww-r37c-vxjw
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-434b-p73k-5fam
9
url VCID-4kym-jhtn-cfa3
vulnerability_id VCID-4kym-jhtn-cfa3
summary 
Liferay Portal Vulnerable to Cross-Site Scripting via assetTagNames Parameter
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScrip in the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_assetTagNames parameter
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43741
reference_id
reference_type
scores
0
value 0.00044
scoring_system epss
scoring_elements 0.14024
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43741
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/264f4f91aa4f8373c5a9cc44420edf1689384cbb
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/264f4f91aa4f8373c5a9cc44420edf1689384cbb
3
reference_url https://liferay.atlassian.net/browse/LPE-18193
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-18193
4
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43741
reference_id CVE-2025-43741
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T15:16:53Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43741
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43741
reference_id CVE-2025-43741
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43741
6
reference_url https://github.com/advisories/GHSA-j6p8-g3rj-ghpm
reference_id GHSA-j6p8-g3rj-ghpm
reference_type
scores
url https://github.com/advisories/GHSA-j6p8-g3rj-ghpm
fixed_packages
aliases CVE-2025-43741, GHSA-j6p8-g3rj-ghpm
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4kym-jhtn-cfa3
10
url VCID-4xqq-69ab-1qew
vulnerability_id VCID-4xqq-69ab-1qew
summary 
Liferay Portal Username Enumeration Vulnerability
Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers to determine if an account exist in the application by inspecting the server processing time of the login request.
references
0
reference_url http://github.com/liferay/liferay-portal/commit/8199c568a66d66d6ad7ac450d3c69f6e0e9bd181
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://github.com/liferay/liferay-portal/commit/8199c568a66d66d6ad7ac450d3c69f6e0e9bd181
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43754
reference_id
reference_type
scores
0
value 0.00078
scoring_system epss
scoring_elements 0.23393
published_at 2026-06-06T12:55:00Z
1
value 0.00078
scoring_system epss
scoring_elements 0.23405
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43754
2
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
3
reference_url https://github.com/liferay/liferay-portal/commit/06b603671f0e76cd50f56d803a310a3c79944d1d
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/06b603671f0e76cd50f56d803a310a3c79944d1d
4
reference_url https://github.com/liferay/liferay-portal/commit/18a88af5409a5085cb094f5bc55229d5e03a9f29
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/18a88af5409a5085cb094f5bc55229d5e03a9f29
5
reference_url https://github.com/liferay/liferay-portal/commit/33697cf599a2c573ef9571696af55476ecc2ada6
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/33697cf599a2c573ef9571696af55476ecc2ada6
6
reference_url https://github.com/liferay/liferay-portal/commit/367dc7d19aa31eaf881f217ceff9610f1747e2d7
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/367dc7d19aa31eaf881f217ceff9610f1747e2d7
7
reference_url https://github.com/liferay/liferay-portal/commit/38c0a06cebf0d635aa2af9912c068217161fcf1e
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/38c0a06cebf0d635aa2af9912c068217161fcf1e
8
reference_url https://github.com/liferay/liferay-portal/commit/45c3ca76966ddfaf8fe650f28910b0f55536f2b4
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/45c3ca76966ddfaf8fe650f28910b0f55536f2b4
9
reference_url https://github.com/liferay/liferay-portal/commit/53e6dcaa31a7599df8de9d3cef92e59e95a2064e
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/53e6dcaa31a7599df8de9d3cef92e59e95a2064e
10
reference_url https://github.com/liferay/liferay-portal/commit/556450752159503476635c44736721ad797fa431
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/556450752159503476635c44736721ad797fa431
11
reference_url https://github.com/liferay/liferay-portal/commit/5b1bf48b0dc2a062928237ab1ea4a2274c63e652
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/5b1bf48b0dc2a062928237ab1ea4a2274c63e652
12
reference_url https://github.com/liferay/liferay-portal/commit/6629bb176c1f58ca852d599c013bd3e97b3312d3
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/6629bb176c1f58ca852d599c013bd3e97b3312d3
13
reference_url https://github.com/liferay/liferay-portal/commit/6f6f9f0922f6a13e21236915b864e0c1c12e47a9
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/6f6f9f0922f6a13e21236915b864e0c1c12e47a9
14
reference_url https://github.com/liferay/liferay-portal/commit/6fdbb052a6e0cbe8b300138fb75f88df69f58799
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/6fdbb052a6e0cbe8b300138fb75f88df69f58799
15
reference_url https://github.com/liferay/liferay-portal/commit/7118e956516d48792fb9365d1ae1f0ee971a8ac3
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/7118e956516d48792fb9365d1ae1f0ee971a8ac3
16
reference_url https://github.com/liferay/liferay-portal/commit/862ca74aaf98c70823022b6556cdc8a339128f79
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/862ca74aaf98c70823022b6556cdc8a339128f79
17
reference_url https://github.com/liferay/liferay-portal/commit/9b4be82e964e9bbab1ce9824a61d9f40b28f38bb
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/9b4be82e964e9bbab1ce9824a61d9f40b28f38bb
18
reference_url https://github.com/liferay/liferay-portal/commit/9ce8b8dec237f9b9049760904fcefd06a8695832
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/9ce8b8dec237f9b9049760904fcefd06a8695832
19
reference_url https://github.com/liferay/liferay-portal/commit/c8041d0f527388305897ac79f98d012bb31b82ac
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/c8041d0f527388305897ac79f98d012bb31b82ac
20
reference_url https://github.com/liferay/liferay-portal/commit/f25bb9583f059f86937649fdacf940928ca3767b
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/f25bb9583f059f86937649fdacf940928ca3767b
21
reference_url https://liferay.atlassian.net/browse/LPE-18149
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-18149
22
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43754
reference_id CVE-2025-43754
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-21T20:01:22Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43754
23
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43754
reference_id CVE-2025-43754
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43754
24
reference_url https://github.com/advisories/GHSA-x7p4-v8mj-6fxx
reference_id GHSA-x7p4-v8mj-6fxx
reference_type
scores
url https://github.com/advisories/GHSA-x7p4-v8mj-6fxx
fixed_packages
aliases CVE-2025-43754, GHSA-x7p4-v8mj-6fxx
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4xqq-69ab-1qew
11
url VCID-5732-ffyz-9fh5
vulnerability_id VCID-5732-ffyz-9fh5
summary 
Liferay Profile Widget does not prevent vCard extension spoofing
The Profile Widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file is downloaded.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43824
reference_id
reference_type
scores
0
value 0.00033
scoring_system epss
scoring_elements 0.10191
published_at 2026-06-06T12:55:00Z
1
value 0.00033
scoring_system epss
scoring_elements 0.10172
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43824
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43824
reference_id CVE-2025-43824
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-07T15:52:30Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43824
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43824
reference_id CVE-2025-43824
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43824
4
reference_url https://github.com/advisories/GHSA-pfxj-gvqg-mj44
reference_id GHSA-pfxj-gvqg-mj44
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-pfxj-gvqg-mj44
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-27a1-teqk-cbe2
1
vulnerability VCID-2bcr-bxek-skfq
2
vulnerability VCID-2dra-x6f5-xybz
3
vulnerability VCID-2mtb-mdha-qufv
4
vulnerability VCID-434b-p73k-5fam
5
vulnerability VCID-4kym-jhtn-cfa3
6
vulnerability VCID-4xqq-69ab-1qew
7
vulnerability VCID-8xx2-vtnr-dubu
8
vulnerability VCID-brjh-tyur-ebc8
9
vulnerability VCID-by7b-2zr9-y3dj
10
vulnerability VCID-ca62-h2qv-v7bg
11
vulnerability VCID-csnj-331s-43ea
12
vulnerability VCID-ebzh-bpks-5qe2
13
vulnerability VCID-evap-nt9g-akf6
14
vulnerability VCID-g41m-xvk2-xfda
15
vulnerability VCID-ggmh-6ef8-7ufj
16
vulnerability VCID-gyge-7d5c-6uhz
17
vulnerability VCID-j3pc-gwg6-qfbs
18
vulnerability VCID-ksvn-b6hv-hfa7
19
vulnerability VCID-nhp5-61h7-ryf4
20
vulnerability VCID-rns1-e6pd-tkex
21
vulnerability VCID-s86p-ew9a-rkgt
22
vulnerability VCID-sw28-urg9-tqgd
23
vulnerability VCID-w7z4-h1ug-z3cq
24
vulnerability VCID-wpqk-8fd9-p3ex
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
aliases CVE-2025-43824, GHSA-pfxj-gvqg-mj44
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5732-ffyz-9fh5
12
url VCID-5bex-xcub-3qhr
vulnerability_id VCID-5bex-xcub-3qhr
summary 
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the `_com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect` parameter.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-26273
reference_id
reference_type
scores
0
value 0.02006
scoring_system epss
scoring_elements 0.84028
published_at 2026-06-05T12:55:00Z
1
value 0.02193
scoring_system epss
scoring_elements 0.84731
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-26273
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26273
reference_id CVE-2024-26273
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:18:21Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26273
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-26273
reference_id CVE-2024-26273
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-26273
4
reference_url https://github.com/advisories/GHSA-hmrx-6pr5-hpwj
reference_id GHSA-hmrx-6pr5-hpwj
reference_type
scores
url https://github.com/advisories/GHSA-hmrx-6pr5-hpwj
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.104
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.104
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-2bcr-bxek-skfq
4
vulnerability VCID-2dra-x6f5-xybz
5
vulnerability VCID-2mtb-mdha-qufv
6
vulnerability VCID-3hm3-htje-akgd
7
vulnerability VCID-434b-p73k-5fam
8
vulnerability VCID-4kym-jhtn-cfa3
9
vulnerability VCID-4xqq-69ab-1qew
10
vulnerability VCID-5732-ffyz-9fh5
11
vulnerability VCID-68yp-31d3-zbay
12
vulnerability VCID-6yrk-8tj5-juhp
13
vulnerability VCID-8xx2-vtnr-dubu
14
vulnerability VCID-brjh-tyur-ebc8
15
vulnerability VCID-by7b-2zr9-y3dj
16
vulnerability VCID-ca62-h2qv-v7bg
17
vulnerability VCID-ce9p-rwsz-zkf6
18
vulnerability VCID-csnj-331s-43ea
19
vulnerability VCID-d56y-s4zt-uyd7
20
vulnerability VCID-ebzh-bpks-5qe2
21
vulnerability VCID-evap-nt9g-akf6
22
vulnerability VCID-g41m-xvk2-xfda
23
vulnerability VCID-ggmh-6ef8-7ufj
24
vulnerability VCID-gyge-7d5c-6uhz
25
vulnerability VCID-hvpx-y297-sbha
26
vulnerability VCID-j3pc-gwg6-qfbs
27
vulnerability VCID-ksvn-b6hv-hfa7
28
vulnerability VCID-nhp5-61h7-ryf4
29
vulnerability VCID-pf71-p73a-xyda
30
vulnerability VCID-qy5u-7m7g-4ben
31
vulnerability VCID-r363-kggk-k3ds
32
vulnerability VCID-rns1-e6pd-tkex
33
vulnerability VCID-rs2y-3c75-uycm
34
vulnerability VCID-s86p-ew9a-rkgt
35
vulnerability VCID-su57-hncy-5qg4
36
vulnerability VCID-sw28-urg9-tqgd
37
vulnerability VCID-tf5n-etq9-2bg1
38
vulnerability VCID-w7z4-h1ug-z3cq
39
vulnerability VCID-wpqk-8fd9-p3ex
40
vulnerability VCID-y1wd-arvg-2ugt
41
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.104
aliases CVE-2024-26273, GHSA-hmrx-6pr5-hpwj
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5bex-xcub-3qhr
13
url VCID-5nq8-gsav-5ffq
vulnerability_id VCID-5nq8-gsav-5ffq
summary 
Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting
Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key` parameter.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-42498
reference_id
reference_type
scores
0
value 0.0044
scoring_system epss
scoring_elements 0.63563
published_at 2026-06-06T12:55:00Z
1
value 0.0044
scoring_system epss
scoring_elements 0.63556
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-42498
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 9.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42498
reference_id CVE-2023-42498
reference_type
scores
0
value 9.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-26T17:54:30Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42498
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-42498
reference_id CVE-2023-42498
reference_type
scores
0
value 9.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-42498
4
reference_url https://github.com/advisories/GHSA-73x3-8mrg-5r93
reference_id GHSA-73x3-8mrg-5r93
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-73x3-8mrg-5r93
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-292m-hgvs-93ey
4
vulnerability VCID-2bcr-bxek-skfq
5
vulnerability VCID-2dra-x6f5-xybz
6
vulnerability VCID-2mtb-mdha-qufv
7
vulnerability VCID-3hm3-htje-akgd
8
vulnerability VCID-434b-p73k-5fam
9
vulnerability VCID-4kym-jhtn-cfa3
10
vulnerability VCID-4xqq-69ab-1qew
11
vulnerability VCID-5732-ffyz-9fh5
12
vulnerability VCID-5bex-xcub-3qhr
13
vulnerability VCID-68yp-31d3-zbay
14
vulnerability VCID-6yrk-8tj5-juhp
15
vulnerability VCID-8xx2-vtnr-dubu
16
vulnerability VCID-b24q-c9nx-hkdy
17
vulnerability VCID-brjh-tyur-ebc8
18
vulnerability VCID-by7b-2zr9-y3dj
19
vulnerability VCID-ca62-h2qv-v7bg
20
vulnerability VCID-ce9p-rwsz-zkf6
21
vulnerability VCID-csnj-331s-43ea
22
vulnerability VCID-d56y-s4zt-uyd7
23
vulnerability VCID-ebzh-bpks-5qe2
24
vulnerability VCID-ej5y-geq1-pkfn
25
vulnerability VCID-evap-nt9g-akf6
26
vulnerability VCID-g41m-xvk2-xfda
27
vulnerability VCID-ggmh-6ef8-7ufj
28
vulnerability VCID-gyge-7d5c-6uhz
29
vulnerability VCID-hvpx-y297-sbha
30
vulnerability VCID-j3pc-gwg6-qfbs
31
vulnerability VCID-ksvn-b6hv-hfa7
32
vulnerability VCID-mbd8-z3ry-cqap
33
vulnerability VCID-nhp5-61h7-ryf4
34
vulnerability VCID-pf71-p73a-xyda
35
vulnerability VCID-qy5u-7m7g-4ben
36
vulnerability VCID-r363-kggk-k3ds
37
vulnerability VCID-rns1-e6pd-tkex
38
vulnerability VCID-rs2y-3c75-uycm
39
vulnerability VCID-s86p-ew9a-rkgt
40
vulnerability VCID-su57-hncy-5qg4
41
vulnerability VCID-sw28-urg9-tqgd
42
vulnerability VCID-tf5n-etq9-2bg1
43
vulnerability VCID-turp-jxv8-1fgy
44
vulnerability VCID-w7z4-h1ug-z3cq
45
vulnerability VCID-wpqk-8fd9-p3ex
46
vulnerability VCID-xv4h-g41b-c7c7
47
vulnerability VCID-y1wd-arvg-2ugt
48
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98
aliases CVE-2023-42498, GHSA-73x3-8mrg-5r93
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5nq8-gsav-5ffq
14
url VCID-68yp-31d3-zbay
vulnerability_id VCID-68yp-31d3-zbay
summary 
Liferay Portal Uses Default Password
Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has changed their initial password, which allows remote users to access and edit content via the API.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43799
reference_id
reference_type
scores
0
value 0.00073
scoring_system epss
scoring_elements 0.22327
published_at 2026-06-05T12:55:00Z
1
value 0.00073
scoring_system epss
scoring_elements 0.22313
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43799
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43799
reference_id CVE-2025-43799
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-15T20:40:56Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43799
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43799
reference_id CVE-2025-43799
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43799
4
reference_url https://github.com/advisories/GHSA-43xf-59vr-g4f2
reference_id GHSA-43xf-59vr-g4f2
reference_type
scores
url https://github.com/advisories/GHSA-43xf-59vr-g4f2
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-2bcr-bxek-skfq
4
vulnerability VCID-2dra-x6f5-xybz
5
vulnerability VCID-2mtb-mdha-qufv
6
vulnerability VCID-434b-p73k-5fam
7
vulnerability VCID-4kym-jhtn-cfa3
8
vulnerability VCID-4xqq-69ab-1qew
9
vulnerability VCID-5732-ffyz-9fh5
10
vulnerability VCID-8xx2-vtnr-dubu
11
vulnerability VCID-brjh-tyur-ebc8
12
vulnerability VCID-by7b-2zr9-y3dj
13
vulnerability VCID-ca62-h2qv-v7bg
14
vulnerability VCID-ce9p-rwsz-zkf6
15
vulnerability VCID-csnj-331s-43ea
16
vulnerability VCID-d56y-s4zt-uyd7
17
vulnerability VCID-ebzh-bpks-5qe2
18
vulnerability VCID-evap-nt9g-akf6
19
vulnerability VCID-g41m-xvk2-xfda
20
vulnerability VCID-ggmh-6ef8-7ufj
21
vulnerability VCID-gyge-7d5c-6uhz
22
vulnerability VCID-j3pc-gwg6-qfbs
23
vulnerability VCID-ksvn-b6hv-hfa7
24
vulnerability VCID-nhp5-61h7-ryf4
25
vulnerability VCID-qy5u-7m7g-4ben
26
vulnerability VCID-r363-kggk-k3ds
27
vulnerability VCID-rns1-e6pd-tkex
28
vulnerability VCID-s86p-ew9a-rkgt
29
vulnerability VCID-su57-hncy-5qg4
30
vulnerability VCID-sw28-urg9-tqgd
31
vulnerability VCID-w7z4-h1ug-z3cq
32
vulnerability VCID-wpqk-8fd9-p3ex
33
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
aliases CVE-2025-43799, GHSA-43xf-59vr-g4f2
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-68yp-31d3-zbay
15
url VCID-6yrk-8tj5-juhp
vulnerability_id VCID-6yrk-8tj5-juhp
summary 
Liferay Portal Vulnerable to CSRF in Headless APIs
CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-62258
reference_id
reference_type
scores
0
value 0.00023
scoring_system epss
scoring_elements 0.06824
published_at 2026-06-06T12:55:00Z
1
value 0.00023
scoring_system epss
scoring_elements 0.0682
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-62258
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 7.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62258
reference_id CVE-2025-62258
reference_type
scores
0
value 7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
1
value 7.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-28T14:59:44Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62258
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-62258
reference_id CVE-2025-62258
reference_type
scores
0
value 7.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-62258
4
reference_url https://github.com/advisories/GHSA-gh4w-8qgq-8w9r
reference_id GHSA-gh4w-8qgq-8w9r
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-gh4w-8qgq-8w9r
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108
1
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-2bcr-bxek-skfq
4
vulnerability VCID-2dra-x6f5-xybz
5
vulnerability VCID-2mtb-mdha-qufv
6
vulnerability VCID-434b-p73k-5fam
7
vulnerability VCID-4kym-jhtn-cfa3
8
vulnerability VCID-4xqq-69ab-1qew
9
vulnerability VCID-5732-ffyz-9fh5
10
vulnerability VCID-8xx2-vtnr-dubu
11
vulnerability VCID-brjh-tyur-ebc8
12
vulnerability VCID-by7b-2zr9-y3dj
13
vulnerability VCID-ca62-h2qv-v7bg
14
vulnerability VCID-ce9p-rwsz-zkf6
15
vulnerability VCID-csnj-331s-43ea
16
vulnerability VCID-d56y-s4zt-uyd7
17
vulnerability VCID-ebzh-bpks-5qe2
18
vulnerability VCID-evap-nt9g-akf6
19
vulnerability VCID-g41m-xvk2-xfda
20
vulnerability VCID-ggmh-6ef8-7ufj
21
vulnerability VCID-gyge-7d5c-6uhz
22
vulnerability VCID-j3pc-gwg6-qfbs
23
vulnerability VCID-ksvn-b6hv-hfa7
24
vulnerability VCID-nhp5-61h7-ryf4
25
vulnerability VCID-qy5u-7m7g-4ben
26
vulnerability VCID-r363-kggk-k3ds
27
vulnerability VCID-rns1-e6pd-tkex
28
vulnerability VCID-s86p-ew9a-rkgt
29
vulnerability VCID-su57-hncy-5qg4
30
vulnerability VCID-sw28-urg9-tqgd
31
vulnerability VCID-w7z4-h1ug-z3cq
32
vulnerability VCID-wpqk-8fd9-p3ex
33
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
aliases CVE-2025-62258, GHSA-gh4w-8qgq-8w9r
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-6yrk-8tj5-juhp
16
url VCID-7tas-6nn4-9fhu
vulnerability_id VCID-7tas-6nn4-9fhu
summary 
Missing permissions check in Liferay Portal
The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.
references
0
reference_url http://liferay.com
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:31:00Z/
url http://liferay.com
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-42126
reference_id
reference_type
scores
0
value 0.00144
scoring_system epss
scoring_elements 0.34559
published_at 2026-06-06T12:55:00Z
1
value 0.00144
scoring_system epss
scoring_elements 0.34445
published_at 2026-06-04T12:55:00Z
2
value 0.00144
scoring_system epss
scoring_elements 0.34543
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-42126
2
reference_url https://issues.liferay.com/browse/LPE-17593
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:31:00Z/
url https://issues.liferay.com/browse/LPE-17593
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-42126
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-42126
4
reference_url https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:31:00Z/
url https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126
5
reference_url https://github.com/advisories/GHSA-642h-mx8q-47p2
reference_id GHSA-642h-mx8q-47p2
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-642h-mx8q-47p2
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.29
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.29
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-292m-hgvs-93ey
4
vulnerability VCID-2bcr-bxek-skfq
5
vulnerability VCID-2dra-x6f5-xybz
6
vulnerability VCID-2mtb-mdha-qufv
7
vulnerability VCID-434b-p73k-5fam
8
vulnerability VCID-4kym-jhtn-cfa3
9
vulnerability VCID-4xqq-69ab-1qew
10
vulnerability VCID-5732-ffyz-9fh5
11
vulnerability VCID-5bex-xcub-3qhr
12
vulnerability VCID-5nq8-gsav-5ffq
13
vulnerability VCID-68yp-31d3-zbay
14
vulnerability VCID-6yrk-8tj5-juhp
15
vulnerability VCID-8xx2-vtnr-dubu
16
vulnerability VCID-b24q-c9nx-hkdy
17
vulnerability VCID-by7b-2zr9-y3dj
18
vulnerability VCID-ca62-h2qv-v7bg
19
vulnerability VCID-ce9p-rwsz-zkf6
20
vulnerability VCID-cj4m-mvzh-ckh4
21
vulnerability VCID-d56y-s4zt-uyd7
22
vulnerability VCID-dvp1-5vf5-qfg9
23
vulnerability VCID-e5h2-wvws-3yhq
24
vulnerability VCID-ebzh-bpks-5qe2
25
vulnerability VCID-ej5y-geq1-pkfn
26
vulnerability VCID-evap-nt9g-akf6
27
vulnerability VCID-g41m-xvk2-xfda
28
vulnerability VCID-gaqh-vn1h-b3c1
29
vulnerability VCID-ggmh-6ef8-7ufj
30
vulnerability VCID-gyge-7d5c-6uhz
31
vulnerability VCID-hvpx-y297-sbha
32
vulnerability VCID-j3pc-gwg6-qfbs
33
vulnerability VCID-ksvn-b6hv-hfa7
34
vulnerability VCID-mgw3-28sj-juh7
35
vulnerability VCID-msd2-mccp-z7cv
36
vulnerability VCID-nhp5-61h7-ryf4
37
vulnerability VCID-patg-tmcj-3qbh
38
vulnerability VCID-pf71-p73a-xyda
39
vulnerability VCID-qks2-mqk8-wffq
40
vulnerability VCID-qrgm-94me-83hz
41
vulnerability VCID-qy5u-7m7g-4ben
42
vulnerability VCID-r363-kggk-k3ds
43
vulnerability VCID-rns1-e6pd-tkex
44
vulnerability VCID-s86p-ew9a-rkgt
45
vulnerability VCID-sw28-urg9-tqgd
46
vulnerability VCID-tf5n-etq9-2bg1
47
vulnerability VCID-turp-jxv8-1fgy
48
vulnerability VCID-v633-mycj-6uh6
49
vulnerability VCID-w7z4-h1ug-z3cq
50
vulnerability VCID-wpqk-8fd9-p3ex
51
vulnerability VCID-wzj5-ba9k-q3at
52
vulnerability VCID-xn1n-5rgc-83bg
53
vulnerability VCID-y1wd-arvg-2ugt
54
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.29
1
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-292m-hgvs-93ey
4
vulnerability VCID-2bcr-bxek-skfq
5
vulnerability VCID-2dra-x6f5-xybz
6
vulnerability VCID-2mtb-mdha-qufv
7
vulnerability VCID-3hm3-htje-akgd
8
vulnerability VCID-434b-p73k-5fam
9
vulnerability VCID-4kym-jhtn-cfa3
10
vulnerability VCID-4xqq-69ab-1qew
11
vulnerability VCID-5732-ffyz-9fh5
12
vulnerability VCID-5bex-xcub-3qhr
13
vulnerability VCID-5nq8-gsav-5ffq
14
vulnerability VCID-68yp-31d3-zbay
15
vulnerability VCID-6yrk-8tj5-juhp
16
vulnerability VCID-8xx2-vtnr-dubu
17
vulnerability VCID-b24q-c9nx-hkdy
18
vulnerability VCID-brjh-tyur-ebc8
19
vulnerability VCID-by7b-2zr9-y3dj
20
vulnerability VCID-ca62-h2qv-v7bg
21
vulnerability VCID-ce9p-rwsz-zkf6
22
vulnerability VCID-d56y-s4zt-uyd7
23
vulnerability VCID-dvp1-5vf5-qfg9
24
vulnerability VCID-e5h2-wvws-3yhq
25
vulnerability VCID-ebzh-bpks-5qe2
26
vulnerability VCID-ej5y-geq1-pkfn
27
vulnerability VCID-evap-nt9g-akf6
28
vulnerability VCID-g41m-xvk2-xfda
29
vulnerability VCID-gaqh-vn1h-b3c1
30
vulnerability VCID-ggmh-6ef8-7ufj
31
vulnerability VCID-gyge-7d5c-6uhz
32
vulnerability VCID-hvpx-y297-sbha
33
vulnerability VCID-j3pc-gwg6-qfbs
34
vulnerability VCID-ksvn-b6hv-hfa7
35
vulnerability VCID-mbd8-z3ry-cqap
36
vulnerability VCID-mf9a-eusx-f3gb
37
vulnerability VCID-nhp5-61h7-ryf4
38
vulnerability VCID-patg-tmcj-3qbh
39
vulnerability VCID-pf71-p73a-xyda
40
vulnerability VCID-qy5u-7m7g-4ben
41
vulnerability VCID-r363-kggk-k3ds
42
vulnerability VCID-rns1-e6pd-tkex
43
vulnerability VCID-s86p-ew9a-rkgt
44
vulnerability VCID-sw28-urg9-tqgd
45
vulnerability VCID-tf5n-etq9-2bg1
46
vulnerability VCID-turp-jxv8-1fgy
47
vulnerability VCID-uun9-ctyg-k3d9
48
vulnerability VCID-v633-mycj-6uh6
49
vulnerability VCID-w7z4-h1ug-z3cq
50
vulnerability VCID-wpqk-8fd9-p3ex
51
vulnerability VCID-xn1n-5rgc-83bg
52
vulnerability VCID-xn3y-rrkc-7bcz
53
vulnerability VCID-y1wd-arvg-2ugt
54
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48
aliases CVE-2022-42126, GHSA-642h-mx8q-47p2
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7tas-6nn4-9fhu
17
url VCID-8xx2-vtnr-dubu
vulnerability_id VCID-8xx2-vtnr-dubu
summary 
Liferay Portal Login Bypass Vulnerability
Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-3639
reference_id
reference_type
scores
0
value 0.00044
scoring_system epss
scoring_elements 0.13777
published_at 2026-06-06T12:55:00Z
1
value 0.00044
scoring_system epss
scoring_elements 0.13774
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-3639
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 2.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/383a4001cfdf533eb077ed6f03bc5f8fed27cf05
reference_id
reference_type
scores
0
value 2.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/383a4001cfdf533eb077ed6f03bc5f8fed27cf05
3
reference_url https://github.com/liferay/liferay-portal/commit/774c89c853d4b9d9abb61d6e079dab21f582cc78
reference_id
reference_type
scores
0
value 2.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/774c89c853d4b9d9abb61d6e079dab21f582cc78
4
reference_url https://github.com/liferay/liferay-portal/commit/7a70daf60416d536a45fe137d54e1054e9394fa7
reference_id
reference_type
scores
0
value 2.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/7a70daf60416d536a45fe137d54e1054e9394fa7
5
reference_url https://github.com/liferay/liferay-portal/commit/a0265c3847af01a37d2a9ad1560e4408f2856518
reference_id
reference_type
scores
0
value 2.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/a0265c3847af01a37d2a9ad1560e4408f2856518
6
reference_url https://github.com/liferay/liferay-portal/commit/a5081fefaffdd86a9306320c46e91f98973c39cb
reference_id
reference_type
scores
0
value 2.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/a5081fefaffdd86a9306320c46e91f98973c39cb
7
reference_url https://github.com/liferay/liferay-portal/commit/d2806ad26cb194d0c7d654f9c447857e05dd44b2
reference_id
reference_type
scores
0
value 2.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/d2806ad26cb194d0c7d654f9c447857e05dd44b2
8
reference_url https://github.com/liferay/liferay-portal/commit/e4bb21b85440157b588ebbd217995113362962cc
reference_id
reference_type
scores
0
value 2.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/e4bb21b85440157b588ebbd217995113362962cc
9
reference_url https://github.com/liferay/liferay-portal/commit/e67b47a47f3bccc9a85aeee6a40cd0188787aa0f
reference_id
reference_type
scores
0
value 2.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/e67b47a47f3bccc9a85aeee6a40cd0188787aa0f
10
reference_url https://github.com/liferay/liferay-portal/commit/eb0457503fdb8ac49c662b690a6a4eb139ee4c67
reference_id
reference_type
scores
0
value 2.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/eb0457503fdb8ac49c662b690a6a4eb139ee4c67
11
reference_url https://liferay.atlassian.net/browse/LPE-18212
reference_id
reference_type
scores
0
value 2.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value LOW
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-18212
12
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3639
reference_id CVE-2025-3639
reference_type
scores
0
value 2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
1
value 2.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-18T19:51:41Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3639
13
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-3639
reference_id CVE-2025-3639
reference_type
scores
0
value 2.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-3639
14
reference_url https://github.com/advisories/GHSA-g4wg-mpfg-x2q6
reference_id GHSA-g4wg-mpfg-x2q6
reference_type
scores
url https://github.com/advisories/GHSA-g4wg-mpfg-x2q6
fixed_packages
aliases CVE-2025-3639, GHSA-g4wg-mpfg-x2q6
risk_score 1.4
exploitability 0.5
weighted_severity 2.7
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-8xx2-vtnr-dubu
18
url VCID-b24q-c9nx-hkdy
vulnerability_id VCID-b24q-c9nx-hkdy
summary 
Liferay Portal Stores Password Reset Tokens in Plain Text
Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-62261
reference_id
reference_type
scores
0
value 0.00025
scoring_system epss
scoring_elements 0.07658
published_at 2026-06-06T12:55:00Z
1
value 0.00025
scoring_system epss
scoring_elements 0.07648
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-62261
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/b228c7878f2ed5ad8dbc1ff7ec9b5e6d53bb4b5c
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/b228c7878f2ed5ad8dbc1ff7ec9b5e6d53bb4b5c
3
reference_url https://liferay.atlassian.net/browse/LPE-17785
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-17785
4
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62261
reference_id CVE-2025-62261
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-28T14:27:39Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62261
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-62261
reference_id CVE-2025-62261
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-62261
6
reference_url https://github.com/advisories/GHSA-xcj6-xpjg-c4xr
reference_id GHSA-xcj6-xpjg-c4xr
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-xcj6-xpjg-c4xr
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-2bcr-bxek-skfq
4
vulnerability VCID-2dra-x6f5-xybz
5
vulnerability VCID-2mtb-mdha-qufv
6
vulnerability VCID-3hm3-htje-akgd
7
vulnerability VCID-434b-p73k-5fam
8
vulnerability VCID-4kym-jhtn-cfa3
9
vulnerability VCID-4xqq-69ab-1qew
10
vulnerability VCID-5732-ffyz-9fh5
11
vulnerability VCID-5bex-xcub-3qhr
12
vulnerability VCID-68yp-31d3-zbay
13
vulnerability VCID-6yrk-8tj5-juhp
14
vulnerability VCID-8xx2-vtnr-dubu
15
vulnerability VCID-brjh-tyur-ebc8
16
vulnerability VCID-by7b-2zr9-y3dj
17
vulnerability VCID-ca62-h2qv-v7bg
18
vulnerability VCID-ce9p-rwsz-zkf6
19
vulnerability VCID-csnj-331s-43ea
20
vulnerability VCID-d56y-s4zt-uyd7
21
vulnerability VCID-ebzh-bpks-5qe2
22
vulnerability VCID-ej5y-geq1-pkfn
23
vulnerability VCID-evap-nt9g-akf6
24
vulnerability VCID-g41m-xvk2-xfda
25
vulnerability VCID-ggmh-6ef8-7ufj
26
vulnerability VCID-gyge-7d5c-6uhz
27
vulnerability VCID-hvpx-y297-sbha
28
vulnerability VCID-j3pc-gwg6-qfbs
29
vulnerability VCID-ksvn-b6hv-hfa7
30
vulnerability VCID-mbd8-z3ry-cqap
31
vulnerability VCID-nhp5-61h7-ryf4
32
vulnerability VCID-pf71-p73a-xyda
33
vulnerability VCID-qy5u-7m7g-4ben
34
vulnerability VCID-r363-kggk-k3ds
35
vulnerability VCID-rns1-e6pd-tkex
36
vulnerability VCID-rs2y-3c75-uycm
37
vulnerability VCID-s86p-ew9a-rkgt
38
vulnerability VCID-su57-hncy-5qg4
39
vulnerability VCID-sw28-urg9-tqgd
40
vulnerability VCID-tf5n-etq9-2bg1
41
vulnerability VCID-turp-jxv8-1fgy
42
vulnerability VCID-w7z4-h1ug-z3cq
43
vulnerability VCID-wpqk-8fd9-p3ex
44
vulnerability VCID-y1wd-arvg-2ugt
45
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100
aliases CVE-2025-62261, GHSA-xcj6-xpjg-c4xr
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-b24q-c9nx-hkdy
19
url VCID-by7b-2zr9-y3dj
vulnerability_id VCID-by7b-2zr9-y3dj
summary 
Liferay Portal CSRF Vulnerability via Endpoint Parameter
A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote attackers to performs cross-origin request on behalf of the authenticated user via the endpoint parameter.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43745
reference_id
reference_type
scores
0
value 0.00036
scoring_system epss
scoring_elements 0.111
published_at 2026-06-05T12:55:00Z
1
value 0.00036
scoring_system epss
scoring_elements 0.11093
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43745
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/037b58f96c9ded47960ab493a68d68aaf32b1a43
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/037b58f96c9ded47960ab493a68d68aaf32b1a43
3
reference_url https://github.com/liferay/liferay-portal/commit/2387ee78fd471ea1c1c4d696aa0cbb1bce72665e
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/2387ee78fd471ea1c1c4d696aa0cbb1bce72665e
4
reference_url https://github.com/liferay/liferay-portal/commit/729dfc202c9d2724b5f3f749ead14eb13832e101
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/729dfc202c9d2724b5f3f749ead14eb13832e101
5
reference_url https://liferay.atlassian.net/browse/LPE-18275
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-18275
6
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43745
reference_id CVE-2025-43745
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-19T19:15:28Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43745
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43745
reference_id CVE-2025-43745
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43745
8
reference_url https://github.com/advisories/GHSA-7q33-gwcm-r6cj
reference_id GHSA-7q33-gwcm-r6cj
reference_type
scores
url https://github.com/advisories/GHSA-7q33-gwcm-r6cj
fixed_packages
aliases CVE-2025-43745, GHSA-7q33-gwcm-r6cj
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-by7b-2zr9-y3dj
20
url VCID-ca62-h2qv-v7bg
vulnerability_id VCID-ca62-h2qv-v7bg
summary 
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery
An SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-4655
reference_id
reference_type
scores
0
value 0.00167
scoring_system epss
scoring_elements 0.37668
published_at 2026-06-06T12:55:00Z
1
value 0.00167
scoring_system epss
scoring_elements 0.37665
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-4655
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4655
reference_id CVE-2025-4655
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-11T18:52:11Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4655
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-4655
reference_id CVE-2025-4655
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-4655
4
reference_url https://github.com/advisories/GHSA-c6g5-g6r7-q4j6
reference_id GHSA-c6g5-g6r7-q4j6
reference_type
scores
url https://github.com/advisories/GHSA-c6g5-g6r7-q4j6
fixed_packages
aliases CVE-2025-4655, GHSA-c6g5-g6r7-q4j6
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ca62-h2qv-v7bg
21
url VCID-ce9p-rwsz-zkf6
vulnerability_id VCID-ce9p-rwsz-zkf6
summary 
Liferay Portal is vulnerable to Stored XSS through Forms text type field
Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form with a rich text type field.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43830
reference_id
reference_type
scores
0
value 0.00031
scoring_system epss
scoring_elements 0.09338
published_at 2026-06-06T12:55:00Z
1
value 0.00031
scoring_system epss
scoring_elements 0.09319
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43830
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43830
reference_id CVE-2025-43830
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-08T13:36:35Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43830
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43830
reference_id CVE-2025-43830
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43830
4
reference_url https://github.com/advisories/GHSA-378f-8q54-3fqx
reference_id GHSA-378f-8q54-3fqx
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-378f-8q54-3fqx
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-27a1-teqk-cbe2
1
vulnerability VCID-2bcr-bxek-skfq
2
vulnerability VCID-2dra-x6f5-xybz
3
vulnerability VCID-2mtb-mdha-qufv
4
vulnerability VCID-434b-p73k-5fam
5
vulnerability VCID-4kym-jhtn-cfa3
6
vulnerability VCID-4xqq-69ab-1qew
7
vulnerability VCID-8xx2-vtnr-dubu
8
vulnerability VCID-brjh-tyur-ebc8
9
vulnerability VCID-by7b-2zr9-y3dj
10
vulnerability VCID-ca62-h2qv-v7bg
11
vulnerability VCID-csnj-331s-43ea
12
vulnerability VCID-ebzh-bpks-5qe2
13
vulnerability VCID-evap-nt9g-akf6
14
vulnerability VCID-g41m-xvk2-xfda
15
vulnerability VCID-ggmh-6ef8-7ufj
16
vulnerability VCID-gyge-7d5c-6uhz
17
vulnerability VCID-j3pc-gwg6-qfbs
18
vulnerability VCID-ksvn-b6hv-hfa7
19
vulnerability VCID-nhp5-61h7-ryf4
20
vulnerability VCID-rns1-e6pd-tkex
21
vulnerability VCID-s86p-ew9a-rkgt
22
vulnerability VCID-sw28-urg9-tqgd
23
vulnerability VCID-w7z4-h1ug-z3cq
24
vulnerability VCID-wpqk-8fd9-p3ex
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
aliases CVE-2025-43830, GHSA-378f-8q54-3fqx
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ce9p-rwsz-zkf6
22
url VCID-cj4m-mvzh-ckh4
vulnerability_id VCID-cj4m-mvzh-ckh4
summary 
Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting
Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.1.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38, 7.3 GA through update 36, 7.2 GA through fix pack 20 and 7.1 GA through fix pack 28 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-11993
reference_id
reference_type
scores
0
value 0.00175
scoring_system epss
scoring_elements 0.38799
published_at 2026-06-06T12:55:00Z
1
value 0.00175
scoring_system epss
scoring_elements 0.38795
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-11993
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value 4.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993
reference_id CVE-2024-11993
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value 4.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-17T21:24:48Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-11993
reference_id CVE-2024-11993
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value 4.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-11993
4
reference_url https://github.com/advisories/GHSA-4hxr-28mv-q729
reference_id GHSA-4hxr-28mv-q729
reference_type
scores
url https://github.com/advisories/GHSA-4hxr-28mv-q729
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.39
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.39
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-292m-hgvs-93ey
4
vulnerability VCID-2bcr-bxek-skfq
5
vulnerability VCID-2dra-x6f5-xybz
6
vulnerability VCID-2mtb-mdha-qufv
7
vulnerability VCID-3hm3-htje-akgd
8
vulnerability VCID-434b-p73k-5fam
9
vulnerability VCID-4kym-jhtn-cfa3
10
vulnerability VCID-4xqq-69ab-1qew
11
vulnerability VCID-5732-ffyz-9fh5
12
vulnerability VCID-5bex-xcub-3qhr
13
vulnerability VCID-5nq8-gsav-5ffq
14
vulnerability VCID-68yp-31d3-zbay
15
vulnerability VCID-6yrk-8tj5-juhp
16
vulnerability VCID-8xx2-vtnr-dubu
17
vulnerability VCID-b24q-c9nx-hkdy
18
vulnerability VCID-by7b-2zr9-y3dj
19
vulnerability VCID-ca62-h2qv-v7bg
20
vulnerability VCID-ce9p-rwsz-zkf6
21
vulnerability VCID-d56y-s4zt-uyd7
22
vulnerability VCID-dvp1-5vf5-qfg9
23
vulnerability VCID-e5h2-wvws-3yhq
24
vulnerability VCID-ebzh-bpks-5qe2
25
vulnerability VCID-ej5y-geq1-pkfn
26
vulnerability VCID-evap-nt9g-akf6
27
vulnerability VCID-g41m-xvk2-xfda
28
vulnerability VCID-gaqh-vn1h-b3c1
29
vulnerability VCID-ggmh-6ef8-7ufj
30
vulnerability VCID-gyge-7d5c-6uhz
31
vulnerability VCID-hvpx-y297-sbha
32
vulnerability VCID-j3pc-gwg6-qfbs
33
vulnerability VCID-ksvn-b6hv-hfa7
34
vulnerability VCID-nhp5-61h7-ryf4
35
vulnerability VCID-patg-tmcj-3qbh
36
vulnerability VCID-pf71-p73a-xyda
37
vulnerability VCID-qy5u-7m7g-4ben
38
vulnerability VCID-r363-kggk-k3ds
39
vulnerability VCID-rns1-e6pd-tkex
40
vulnerability VCID-s86p-ew9a-rkgt
41
vulnerability VCID-sw28-urg9-tqgd
42
vulnerability VCID-tf5n-etq9-2bg1
43
vulnerability VCID-turp-jxv8-1fgy
44
vulnerability VCID-v633-mycj-6uh6
45
vulnerability VCID-w7z4-h1ug-z3cq
46
vulnerability VCID-wpqk-8fd9-p3ex
47
vulnerability VCID-wzj5-ba9k-q3at
48
vulnerability VCID-xn1n-5rgc-83bg
49
vulnerability VCID-y1wd-arvg-2ugt
50
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.39
aliases CVE-2024-11993, GHSA-4hxr-28mv-q729
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cj4m-mvzh-ckh4
23
url VCID-d56y-s4zt-uyd7
vulnerability_id VCID-d56y-s4zt-uyd7
summary 
Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter
Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId` parameter.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-62264
reference_id
reference_type
scores
0
value 0.00031
scoring_system epss
scoring_elements 0.09338
published_at 2026-06-06T12:55:00Z
1
value 0.00032
scoring_system epss
scoring_elements 0.09873
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-62264
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62264
reference_id CVE-2025-62264
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-31T17:52:20Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62264
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-62264
reference_id CVE-2025-62264
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-62264
4
reference_url https://github.com/advisories/GHSA-2j97-4jmq-c4xf
reference_id GHSA-2j97-4jmq-c4xf
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-2j97-4jmq-c4xf
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-27a1-teqk-cbe2
1
vulnerability VCID-2bcr-bxek-skfq
2
vulnerability VCID-2dra-x6f5-xybz
3
vulnerability VCID-2mtb-mdha-qufv
4
vulnerability VCID-434b-p73k-5fam
5
vulnerability VCID-4kym-jhtn-cfa3
6
vulnerability VCID-4xqq-69ab-1qew
7
vulnerability VCID-8xx2-vtnr-dubu
8
vulnerability VCID-brjh-tyur-ebc8
9
vulnerability VCID-by7b-2zr9-y3dj
10
vulnerability VCID-ca62-h2qv-v7bg
11
vulnerability VCID-csnj-331s-43ea
12
vulnerability VCID-ebzh-bpks-5qe2
13
vulnerability VCID-evap-nt9g-akf6
14
vulnerability VCID-g41m-xvk2-xfda
15
vulnerability VCID-ggmh-6ef8-7ufj
16
vulnerability VCID-gyge-7d5c-6uhz
17
vulnerability VCID-j3pc-gwg6-qfbs
18
vulnerability VCID-ksvn-b6hv-hfa7
19
vulnerability VCID-nhp5-61h7-ryf4
20
vulnerability VCID-rns1-e6pd-tkex
21
vulnerability VCID-s86p-ew9a-rkgt
22
vulnerability VCID-sw28-urg9-tqgd
23
vulnerability VCID-w7z4-h1ug-z3cq
24
vulnerability VCID-wpqk-8fd9-p3ex
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
aliases CVE-2025-62264, GHSA-2j97-4jmq-c4xf
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-d56y-s4zt-uyd7
24
url VCID-dvp1-5vf5-qfg9
vulnerability_id VCID-dvp1-5vf5-qfg9
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's (1) First Name, (2) Middle Name, (3) Last Name, or (4) Job Title text field.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-33943
reference_id
reference_type
scores
0
value 0.00296
scoring_system epss
scoring_elements 0.53255
published_at 2026-06-05T12:55:00Z
1
value 0.00296
scoring_system epss
scoring_elements 0.53263
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-33943
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33943
reference_id CVE-2023-33943
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-22T15:46:56Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33943
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-33943
reference_id CVE-2023-33943
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-33943
4
reference_url https://github.com/advisories/GHSA-p9xg-9378-cqp7
reference_id GHSA-p9xg-9378-cqp7
reference_type
scores
url https://github.com/advisories/GHSA-p9xg-9378-cqp7
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.63
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.63
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-292m-hgvs-93ey
4
vulnerability VCID-2bcr-bxek-skfq
5
vulnerability VCID-2dra-x6f5-xybz
6
vulnerability VCID-2mtb-mdha-qufv
7
vulnerability VCID-3hm3-htje-akgd
8
vulnerability VCID-434b-p73k-5fam
9
vulnerability VCID-4kym-jhtn-cfa3
10
vulnerability VCID-4xqq-69ab-1qew
11
vulnerability VCID-5732-ffyz-9fh5
12
vulnerability VCID-5bex-xcub-3qhr
13
vulnerability VCID-5nq8-gsav-5ffq
14
vulnerability VCID-68yp-31d3-zbay
15
vulnerability VCID-6yrk-8tj5-juhp
16
vulnerability VCID-8xx2-vtnr-dubu
17
vulnerability VCID-b24q-c9nx-hkdy
18
vulnerability VCID-brjh-tyur-ebc8
19
vulnerability VCID-by7b-2zr9-y3dj
20
vulnerability VCID-ca62-h2qv-v7bg
21
vulnerability VCID-ce9p-rwsz-zkf6
22
vulnerability VCID-d56y-s4zt-uyd7
23
vulnerability VCID-e5h2-wvws-3yhq
24
vulnerability VCID-ebzh-bpks-5qe2
25
vulnerability VCID-ej5y-geq1-pkfn
26
vulnerability VCID-evap-nt9g-akf6
27
vulnerability VCID-g41m-xvk2-xfda
28
vulnerability VCID-gaqh-vn1h-b3c1
29
vulnerability VCID-ggmh-6ef8-7ufj
30
vulnerability VCID-gyge-7d5c-6uhz
31
vulnerability VCID-hvpx-y297-sbha
32
vulnerability VCID-j3pc-gwg6-qfbs
33
vulnerability VCID-ksvn-b6hv-hfa7
34
vulnerability VCID-mbd8-z3ry-cqap
35
vulnerability VCID-mf9a-eusx-f3gb
36
vulnerability VCID-nhp5-61h7-ryf4
37
vulnerability VCID-pf71-p73a-xyda
38
vulnerability VCID-qy5u-7m7g-4ben
39
vulnerability VCID-r363-kggk-k3ds
40
vulnerability VCID-rns1-e6pd-tkex
41
vulnerability VCID-s86p-ew9a-rkgt
42
vulnerability VCID-sw28-urg9-tqgd
43
vulnerability VCID-tf5n-etq9-2bg1
44
vulnerability VCID-turp-jxv8-1fgy
45
vulnerability VCID-uun9-ctyg-k3d9
46
vulnerability VCID-w7z4-h1ug-z3cq
47
vulnerability VCID-wpqk-8fd9-p3ex
48
vulnerability VCID-xn1n-5rgc-83bg
49
vulnerability VCID-y1wd-arvg-2ugt
50
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.63
aliases CVE-2023-33943, GHSA-p9xg-9378-cqp7
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dvp1-5vf5-qfg9
25
url VCID-e5h2-wvws-3yhq
vulnerability_id VCID-e5h2-wvws-3yhq
summary 
Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page
Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's `Service Class` text field.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-37940
reference_id
reference_type
scores
0
value 0.00175
scoring_system epss
scoring_elements 0.38795
published_at 2026-06-05T12:55:00Z
1
value 0.00175
scoring_system epss
scoring_elements 0.38799
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-37940
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940
reference_id CVE-2023-37940
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-17T21:41:20Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-37940
reference_id CVE-2023-37940
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-37940
4
reference_url https://github.com/advisories/GHSA-px38-239g-x5mg
reference_id GHSA-px38-239g-x5mg
reference_type
scores
url https://github.com/advisories/GHSA-px38-239g-x5mg
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.88
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.88
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-292m-hgvs-93ey
4
vulnerability VCID-2bcr-bxek-skfq
5
vulnerability VCID-2dra-x6f5-xybz
6
vulnerability VCID-2mtb-mdha-qufv
7
vulnerability VCID-3hm3-htje-akgd
8
vulnerability VCID-434b-p73k-5fam
9
vulnerability VCID-4kym-jhtn-cfa3
10
vulnerability VCID-4xqq-69ab-1qew
11
vulnerability VCID-5732-ffyz-9fh5
12
vulnerability VCID-5bex-xcub-3qhr
13
vulnerability VCID-5nq8-gsav-5ffq
14
vulnerability VCID-68yp-31d3-zbay
15
vulnerability VCID-6yrk-8tj5-juhp
16
vulnerability VCID-8xx2-vtnr-dubu
17
vulnerability VCID-b24q-c9nx-hkdy
18
vulnerability VCID-brjh-tyur-ebc8
19
vulnerability VCID-by7b-2zr9-y3dj
20
vulnerability VCID-ca62-h2qv-v7bg
21
vulnerability VCID-ce9p-rwsz-zkf6
22
vulnerability VCID-csnj-331s-43ea
23
vulnerability VCID-d56y-s4zt-uyd7
24
vulnerability VCID-ebzh-bpks-5qe2
25
vulnerability VCID-ej5y-geq1-pkfn
26
vulnerability VCID-evap-nt9g-akf6
27
vulnerability VCID-g41m-xvk2-xfda
28
vulnerability VCID-ggmh-6ef8-7ufj
29
vulnerability VCID-gyge-7d5c-6uhz
30
vulnerability VCID-hvpx-y297-sbha
31
vulnerability VCID-j3pc-gwg6-qfbs
32
vulnerability VCID-ksvn-b6hv-hfa7
33
vulnerability VCID-mbd8-z3ry-cqap
34
vulnerability VCID-mf9a-eusx-f3gb
35
vulnerability VCID-nhp5-61h7-ryf4
36
vulnerability VCID-pf71-p73a-xyda
37
vulnerability VCID-qy5u-7m7g-4ben
38
vulnerability VCID-r363-kggk-k3ds
39
vulnerability VCID-rns1-e6pd-tkex
40
vulnerability VCID-rs2y-3c75-uycm
41
vulnerability VCID-s86p-ew9a-rkgt
42
vulnerability VCID-su57-hncy-5qg4
43
vulnerability VCID-sw28-urg9-tqgd
44
vulnerability VCID-tf5n-etq9-2bg1
45
vulnerability VCID-turp-jxv8-1fgy
46
vulnerability VCID-w7z4-h1ug-z3cq
47
vulnerability VCID-wpqk-8fd9-p3ex
48
vulnerability VCID-xn1n-5rgc-83bg
49
vulnerability VCID-xv4h-g41b-c7c7
50
vulnerability VCID-y1wd-arvg-2ugt
51
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.88
aliases CVE-2023-37940, GHSA-px38-239g-x5mg
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-e5h2-wvws-3yhq
26
url VCID-ebzh-bpks-5qe2
vulnerability_id VCID-ebzh-bpks-5qe2
summary 
Liferay Cross-site Scripting vulnerability
A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-3760
reference_id
reference_type
scores
0
value 0.00157
scoring_system epss
scoring_elements 0.363
published_at 2026-06-05T12:55:00Z
1
value 0.00157
scoring_system epss
scoring_elements 0.36309
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-3760
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3760
reference_id CVE-2025-3760
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-17T13:22:03Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3760
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-3760
reference_id CVE-2025-3760
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-3760
4
reference_url https://github.com/advisories/GHSA-qhp6-vp7c-g7xp
reference_id GHSA-qhp6-vp7c-g7xp
reference_type
scores
url https://github.com/advisories/GHSA-qhp6-vp7c-g7xp
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-27a1-teqk-cbe2
1
vulnerability VCID-2dra-x6f5-xybz
2
vulnerability VCID-434b-p73k-5fam
3
vulnerability VCID-4kym-jhtn-cfa3
4
vulnerability VCID-4xqq-69ab-1qew
5
vulnerability VCID-8xx2-vtnr-dubu
6
vulnerability VCID-by7b-2zr9-y3dj
7
vulnerability VCID-ca62-h2qv-v7bg
8
vulnerability VCID-evap-nt9g-akf6
9
vulnerability VCID-g41m-xvk2-xfda
10
vulnerability VCID-ggmh-6ef8-7ufj
11
vulnerability VCID-gyge-7d5c-6uhz
12
vulnerability VCID-j3pc-gwg6-qfbs
13
vulnerability VCID-ksvn-b6hv-hfa7
14
vulnerability VCID-s86p-ew9a-rkgt
15
vulnerability VCID-u1pr-9cpx-q3hg
16
vulnerability VCID-w7z4-h1ug-z3cq
17
vulnerability VCID-wpqk-8fd9-p3ex
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132
aliases CVE-2025-3760, GHSA-qhp6-vp7c-g7xp
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ebzh-bpks-5qe2
27
url VCID-ej5y-geq1-pkfn
vulnerability_id VCID-ej5y-geq1-pkfn
summary 
Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting
Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 18 through 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a document's “Title” text field.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-47795
reference_id
reference_type
scores
0
value 0.00458
scoring_system epss
scoring_elements 0.64361
published_at 2026-06-06T12:55:00Z
1
value 0.00458
scoring_system epss
scoring_elements 0.64352
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-47795
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 9.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47795
reference_id CVE-2023-47795
reference_type
scores
0
value 9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
1
value 9.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T18:14:14Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47795
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-47795
reference_id CVE-2023-47795
reference_type
scores
0
value 9.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-47795
4
reference_url https://github.com/advisories/GHSA-q2cv-7j58-rfmj
reference_id GHSA-q2cv-7j58-rfmj
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-q2cv-7j58-rfmj
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.102
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.102
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-2bcr-bxek-skfq
4
vulnerability VCID-2dra-x6f5-xybz
5
vulnerability VCID-2mtb-mdha-qufv
6
vulnerability VCID-3hm3-htje-akgd
7
vulnerability VCID-434b-p73k-5fam
8
vulnerability VCID-4kym-jhtn-cfa3
9
vulnerability VCID-4xqq-69ab-1qew
10
vulnerability VCID-5732-ffyz-9fh5
11
vulnerability VCID-5bex-xcub-3qhr
12
vulnerability VCID-68yp-31d3-zbay
13
vulnerability VCID-6yrk-8tj5-juhp
14
vulnerability VCID-8xx2-vtnr-dubu
15
vulnerability VCID-brjh-tyur-ebc8
16
vulnerability VCID-by7b-2zr9-y3dj
17
vulnerability VCID-ca62-h2qv-v7bg
18
vulnerability VCID-ce9p-rwsz-zkf6
19
vulnerability VCID-csnj-331s-43ea
20
vulnerability VCID-d56y-s4zt-uyd7
21
vulnerability VCID-ebzh-bpks-5qe2
22
vulnerability VCID-evap-nt9g-akf6
23
vulnerability VCID-g41m-xvk2-xfda
24
vulnerability VCID-ggmh-6ef8-7ufj
25
vulnerability VCID-gyge-7d5c-6uhz
26
vulnerability VCID-hvpx-y297-sbha
27
vulnerability VCID-j3pc-gwg6-qfbs
28
vulnerability VCID-ksvn-b6hv-hfa7
29
vulnerability VCID-mbd8-z3ry-cqap
30
vulnerability VCID-nhp5-61h7-ryf4
31
vulnerability VCID-pf71-p73a-xyda
32
vulnerability VCID-qy5u-7m7g-4ben
33
vulnerability VCID-r363-kggk-k3ds
34
vulnerability VCID-rns1-e6pd-tkex
35
vulnerability VCID-rs2y-3c75-uycm
36
vulnerability VCID-s86p-ew9a-rkgt
37
vulnerability VCID-su57-hncy-5qg4
38
vulnerability VCID-sw28-urg9-tqgd
39
vulnerability VCID-tf5n-etq9-2bg1
40
vulnerability VCID-turp-jxv8-1fgy
41
vulnerability VCID-w7z4-h1ug-z3cq
42
vulnerability VCID-wpqk-8fd9-p3ex
43
vulnerability VCID-y1wd-arvg-2ugt
44
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.102
aliases CVE-2023-47795, GHSA-q2cv-7j58-rfmj
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ej5y-geq1-pkfn
28
url VCID-evap-nt9g-akf6
vulnerability_id VCID-evap-nt9g-akf6
summary 
Liferay Portal Vulnerable to Cross-Site Scripting
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43731
reference_id
reference_type
scores
0
value 0.00048
scoring_system epss
scoring_elements 0.15376
published_at 2026-06-05T12:55:00Z
1
value 0.00048
scoring_system epss
scoring_elements 0.15367
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43731
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/41708aa542c103521427ecf06f4b20cb37c65ecf
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/41708aa542c103521427ecf06f4b20cb37c65ecf
3
reference_url https://github.com/liferay/liferay-portal/commit/cd1c692dfed3bbebe10074ecb89c561893fffaf9
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/cd1c692dfed3bbebe10074ecb89c561893fffaf9
4
reference_url https://github.com/liferay/liferay-portal/commit/f23921fc93cf713f27ed9c4d31b8c1854c0e2abb
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/f23921fc93cf713f27ed9c4d31b8c1854c0e2abb
5
reference_url https://liferay.atlassian.net/browse/LPE-18217
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-18217
6
reference_url https://liferay.atlassian.net/browse/LPE-18219
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-18219
7
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43731
reference_id CVE-2025-43731
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-18T18:37:36Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43731
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43731
reference_id CVE-2025-43731
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43731
9
reference_url https://github.com/advisories/GHSA-3p2m-574v-v257
reference_id GHSA-3p2m-574v-v257
reference_type
scores
url https://github.com/advisories/GHSA-3p2m-574v-v257
fixed_packages
aliases CVE-2025-43731, GHSA-3p2m-574v-v257
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-evap-nt9g-akf6
29
url VCID-g41m-xvk2-xfda
vulnerability_id VCID-g41m-xvk2-xfda
summary 
Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43734
reference_id
reference_type
scores
0
value 0.00048
scoring_system epss
scoring_elements 0.15367
published_at 2026-06-06T12:55:00Z
1
value 0.00048
scoring_system epss
scoring_elements 0.15376
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43734
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/b4ca1bb0961cc1f230508e072c30815eabce062f
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/b4ca1bb0961cc1f230508e072c30815eabce062f
3
reference_url https://liferay.atlassian.net/browse/LPE-18234
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-18234
4
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43734
reference_id CVE-2025-43734
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-12T19:00:01Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43734
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43734
reference_id CVE-2025-43734
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43734
6
reference_url https://github.com/advisories/GHSA-m5c7-5gv3-hcpf
reference_id GHSA-m5c7-5gv3-hcpf
reference_type
scores
url https://github.com/advisories/GHSA-m5c7-5gv3-hcpf
fixed_packages
aliases CVE-2025-43734, GHSA-m5c7-5gv3-hcpf
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-g41m-xvk2-xfda
30
url VCID-gaqh-vn1h-b3c1
vulnerability_id VCID-gaqh-vn1h-b3c1
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's `URL` text field.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-33944
reference_id
reference_type
scores
0
value 0.00304
scoring_system epss
scoring_elements 0.5399
published_at 2026-06-05T12:55:00Z
1
value 0.00304
scoring_system epss
scoring_elements 0.53997
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-33944
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33944
reference_id CVE-2023-33944
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-22T15:45:15Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33944
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-33944
reference_id CVE-2023-33944
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-33944
4
reference_url https://github.com/advisories/GHSA-pfwc-4frf-4gf8
reference_id GHSA-pfwc-4frf-4gf8
reference_type
scores
url https://github.com/advisories/GHSA-pfwc-4frf-4gf8
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.69
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.69
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-292m-hgvs-93ey
4
vulnerability VCID-2bcr-bxek-skfq
5
vulnerability VCID-2dra-x6f5-xybz
6
vulnerability VCID-2mtb-mdha-qufv
7
vulnerability VCID-3hm3-htje-akgd
8
vulnerability VCID-434b-p73k-5fam
9
vulnerability VCID-4kym-jhtn-cfa3
10
vulnerability VCID-4xqq-69ab-1qew
11
vulnerability VCID-5732-ffyz-9fh5
12
vulnerability VCID-5bex-xcub-3qhr
13
vulnerability VCID-5nq8-gsav-5ffq
14
vulnerability VCID-68yp-31d3-zbay
15
vulnerability VCID-6yrk-8tj5-juhp
16
vulnerability VCID-8xx2-vtnr-dubu
17
vulnerability VCID-b24q-c9nx-hkdy
18
vulnerability VCID-brjh-tyur-ebc8
19
vulnerability VCID-by7b-2zr9-y3dj
20
vulnerability VCID-ca62-h2qv-v7bg
21
vulnerability VCID-ce9p-rwsz-zkf6
22
vulnerability VCID-d56y-s4zt-uyd7
23
vulnerability VCID-e5h2-wvws-3yhq
24
vulnerability VCID-ebzh-bpks-5qe2
25
vulnerability VCID-ej5y-geq1-pkfn
26
vulnerability VCID-evap-nt9g-akf6
27
vulnerability VCID-g41m-xvk2-xfda
28
vulnerability VCID-ggmh-6ef8-7ufj
29
vulnerability VCID-gyge-7d5c-6uhz
30
vulnerability VCID-hvpx-y297-sbha
31
vulnerability VCID-j3pc-gwg6-qfbs
32
vulnerability VCID-ksvn-b6hv-hfa7
33
vulnerability VCID-mbd8-z3ry-cqap
34
vulnerability VCID-mf9a-eusx-f3gb
35
vulnerability VCID-nhp5-61h7-ryf4
36
vulnerability VCID-pf71-p73a-xyda
37
vulnerability VCID-qy5u-7m7g-4ben
38
vulnerability VCID-r363-kggk-k3ds
39
vulnerability VCID-rns1-e6pd-tkex
40
vulnerability VCID-s86p-ew9a-rkgt
41
vulnerability VCID-sw28-urg9-tqgd
42
vulnerability VCID-tf5n-etq9-2bg1
43
vulnerability VCID-turp-jxv8-1fgy
44
vulnerability VCID-uun9-ctyg-k3d9
45
vulnerability VCID-w7z4-h1ug-z3cq
46
vulnerability VCID-wpqk-8fd9-p3ex
47
vulnerability VCID-xn1n-5rgc-83bg
48
vulnerability VCID-y1wd-arvg-2ugt
49
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.69
aliases CVE-2023-33944, GHSA-pfwc-4frf-4gf8
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-gaqh-vn1h-b3c1
31
url VCID-ggmh-6ef8-7ufj
vulnerability_id VCID-ggmh-6ef8-7ufj
summary 
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allow a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web component due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-4581
reference_id
reference_type
scores
0
value 0.00195
scoring_system epss
scoring_elements 0.41279
published_at 2026-06-05T12:55:00Z
1
value 0.00195
scoring_system epss
scoring_elements 0.41283
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-4581
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4581
reference_id CVE-2025-4581
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-11T18:52:25Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4581
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-4581
reference_id CVE-2025-4581
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-4581
4
reference_url https://github.com/advisories/GHSA-6v93-frf9-2rp8
reference_id GHSA-6v93-frf9-2rp8
reference_type
scores
url https://github.com/advisories/GHSA-6v93-frf9-2rp8
fixed_packages
aliases CVE-2025-4581, GHSA-6v93-frf9-2rp8
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ggmh-6ef8-7ufj
32
url VCID-gyge-7d5c-6uhz
vulnerability_id VCID-gyge-7d5c-6uhz
summary 
Liferay Portal's Unlimited File Upload Could Result in DoS
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the object entries attachment fields, the files are stored in the document_library allowing an attacker to cause a potential DDoS.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43752
reference_id
reference_type
scores
0
value 0.0011
scoring_system epss
scoring_elements 0.28956
published_at 2026-06-05T12:55:00Z
1
value 0.0011
scoring_system epss
scoring_elements 0.2892
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43752
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/45dda30252d83912307491d8ed8802577871fa25
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/45dda30252d83912307491d8ed8802577871fa25
3
reference_url https://github.com/liferay/liferay-portal/commit/f3e4723acdf15d3f690d401d6eb6a5653e5be391
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/f3e4723acdf15d3f690d401d6eb6a5653e5be391
4
reference_url https://github.com/liferay/liferay-portal/commit/fffed67b3fd1cc6071fd25a9b104b7691ffea2f8
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/fffed67b3fd1cc6071fd25a9b104b7691ffea2f8
5
reference_url https://liferay.atlassian.net/browse/LPE-18188
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-18188
6
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43752
reference_id CVE-2025-43752
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-22T11:27:55Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43752
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43752
reference_id CVE-2025-43752
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43752
8
reference_url https://github.com/advisories/GHSA-qpp6-f3qj-rggq
reference_id GHSA-qpp6-f3qj-rggq
reference_type
scores
url https://github.com/advisories/GHSA-qpp6-f3qj-rggq
fixed_packages
aliases CVE-2025-43752, GHSA-qpp6-f3qj-rggq
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-gyge-7d5c-6uhz
33
url VCID-hvpx-y297-sbha
vulnerability_id VCID-hvpx-y297-sbha
summary 
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the p_l_back_url parameter.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-26272
reference_id
reference_type
scores
0
value 0.03261
scoring_system epss
scoring_elements 0.87402
published_at 2026-06-06T12:55:00Z
1
value 0.06126
scoring_system epss
scoring_elements 0.90964
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-26272
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26272
reference_id CVE-2024-26272
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:15:06Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26272
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-26272
reference_id CVE-2024-26272
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-26272
4
reference_url https://github.com/advisories/GHSA-p63m-vmjr-wg37
reference_id GHSA-p63m-vmjr-wg37
reference_type
scores
url https://github.com/advisories/GHSA-p63m-vmjr-wg37
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108
1
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-2bcr-bxek-skfq
4
vulnerability VCID-2dra-x6f5-xybz
5
vulnerability VCID-2mtb-mdha-qufv
6
vulnerability VCID-434b-p73k-5fam
7
vulnerability VCID-4kym-jhtn-cfa3
8
vulnerability VCID-4xqq-69ab-1qew
9
vulnerability VCID-5732-ffyz-9fh5
10
vulnerability VCID-8xx2-vtnr-dubu
11
vulnerability VCID-brjh-tyur-ebc8
12
vulnerability VCID-by7b-2zr9-y3dj
13
vulnerability VCID-ca62-h2qv-v7bg
14
vulnerability VCID-ce9p-rwsz-zkf6
15
vulnerability VCID-csnj-331s-43ea
16
vulnerability VCID-d56y-s4zt-uyd7
17
vulnerability VCID-ebzh-bpks-5qe2
18
vulnerability VCID-evap-nt9g-akf6
19
vulnerability VCID-g41m-xvk2-xfda
20
vulnerability VCID-ggmh-6ef8-7ufj
21
vulnerability VCID-gyge-7d5c-6uhz
22
vulnerability VCID-j3pc-gwg6-qfbs
23
vulnerability VCID-ksvn-b6hv-hfa7
24
vulnerability VCID-nhp5-61h7-ryf4
25
vulnerability VCID-qy5u-7m7g-4ben
26
vulnerability VCID-r363-kggk-k3ds
27
vulnerability VCID-rns1-e6pd-tkex
28
vulnerability VCID-s86p-ew9a-rkgt
29
vulnerability VCID-su57-hncy-5qg4
30
vulnerability VCID-sw28-urg9-tqgd
31
vulnerability VCID-w7z4-h1ug-z3cq
32
vulnerability VCID-wpqk-8fd9-p3ex
33
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
aliases CVE-2024-26272, GHSA-p63m-vmjr-wg37
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-hvpx-y297-sbha
34
url VCID-j3pc-gwg6-qfbs
vulnerability_id VCID-j3pc-gwg6-qfbs
summary 
Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels
A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 exists in the Asset Publisher configuration UI within the Source.js module. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels which are then inserted into the DOM using innerHTML without proper encoding.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43744
reference_id
reference_type
scores
0
value 0.0005
scoring_system epss
scoring_elements 0.15904
published_at 2026-06-06T12:55:00Z
1
value 0.0005
scoring_system epss
scoring_elements 0.15915
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43744
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/3b36fadfe92437deab4a55029a1a369e046f3829
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/3b36fadfe92437deab4a55029a1a369e046f3829
3
reference_url https://github.com/liferay/liferay-portal/commit/c07a490b3d3759f38c5473cda74e99540bd0235e
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/c07a490b3d3759f38c5473cda74e99540bd0235e
4
reference_url https://liferay.atlassian.net/browse/LPE-18271
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-18271
5
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43744
reference_id CVE-2025-43744
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T14:14:31Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43744
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43744
reference_id CVE-2025-43744
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43744
7
reference_url https://github.com/advisories/GHSA-m49p-6cjp-x2h3
reference_id GHSA-m49p-6cjp-x2h3
reference_type
scores
url https://github.com/advisories/GHSA-m49p-6cjp-x2h3
fixed_packages
aliases CVE-2025-43744, GHSA-m49p-6cjp-x2h3
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-j3pc-gwg6-qfbs
35
url VCID-ksvn-b6hv-hfa7
vulnerability_id VCID-ksvn-b6hv-hfa7
summary 
Liferay Portal Enumeration Discrepancy in Calendars
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated remote user to view other calendars by allowing them to enumerate the names of other users, given an attacker the possibility to send phishing to these users.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43743
reference_id
reference_type
scores
0
value 0.00081
scoring_system epss
scoring_elements 0.2395
published_at 2026-06-06T12:55:00Z
1
value 0.00081
scoring_system epss
scoring_elements 0.23967
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43743
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/02528147664475cd9f7205cd8bc05dfd43832201
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/02528147664475cd9f7205cd8bc05dfd43832201
3
reference_url https://github.com/liferay/liferay-portal/commit/144e4a276e456c4b7a0831ff038241f82a9181db
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/144e4a276e456c4b7a0831ff038241f82a9181db
4
reference_url https://github.com/liferay/liferay-portal/commit/1513ed29f830c9119ee6be623ae783e545da4845
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/1513ed29f830c9119ee6be623ae783e545da4845
5
reference_url https://github.com/liferay/liferay-portal/commit/1e368205c710403e76749e38127419780acdda9d
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/1e368205c710403e76749e38127419780acdda9d
6
reference_url https://github.com/liferay/liferay-portal/commit/7d6e1bccb62a41e944e0459d2c4b1eb9fdb31b8e
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/7d6e1bccb62a41e944e0459d2c4b1eb9fdb31b8e
7
reference_url https://github.com/liferay/liferay-portal/commit/9a88f7fa98f9fc11a9eab444a256204cccc82b77
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/9a88f7fa98f9fc11a9eab444a256204cccc82b77
8
reference_url https://github.com/liferay/liferay-portal/commit/9aba859a6956786bcd8ce434ef063eed01b5ec6e
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/9aba859a6956786bcd8ce434ef063eed01b5ec6e
9
reference_url https://github.com/liferay/liferay-portal/commit/bd89933cc9022a98fc34b562ce3573a58f14cf38
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/bd89933cc9022a98fc34b562ce3573a58f14cf38
10
reference_url https://github.com/liferay/liferay-portal/commit/d999a8e1902e88fdd7a26758f137925d969a639d
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/d999a8e1902e88fdd7a26758f137925d969a639d
11
reference_url https://liferay.atlassian.net/browse/LPE-18206
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-18206
12
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43743
reference_id CVE-2025-43743
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-19T19:28:02Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43743
13
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43743
reference_id CVE-2025-43743
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43743
14
reference_url https://github.com/advisories/GHSA-g4vp-4gqr-7v8c
reference_id GHSA-g4vp-4gqr-7v8c
reference_type
scores
url https://github.com/advisories/GHSA-g4vp-4gqr-7v8c
fixed_packages
aliases CVE-2025-43743, GHSA-g4vp-4gqr-7v8c
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ksvn-b6hv-hfa7
36
url VCID-mgw3-28sj-juh7
vulnerability_id VCID-mgw3-28sj-juh7
summary 
Path Traversal in Liferay Portal
Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module.
references
0
reference_url http://liferay.com
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:33:53Z/
url http://liferay.com
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-42125
reference_id
reference_type
scores
0
value 0.00418
scoring_system epss
scoring_elements 0.62181
published_at 2026-06-06T12:55:00Z
1
value 0.00418
scoring_system epss
scoring_elements 0.62124
published_at 2026-06-04T12:55:00Z
2
value 0.00418
scoring_system epss
scoring_elements 0.62173
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-42125
2
reference_url https://issues.liferay.com/browse/LPE-17517
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:33:53Z/
url https://issues.liferay.com/browse/LPE-17517
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-42125
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-42125
4
reference_url https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42125
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:33:53Z/
url https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42125
5
reference_url https://github.com/advisories/GHSA-g8hp-rc67-jf96
reference_id GHSA-g8hp-rc67-jf96
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-g8hp-rc67-jf96
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.36
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.36
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-292m-hgvs-93ey
4
vulnerability VCID-2bcr-bxek-skfq
5
vulnerability VCID-2dra-x6f5-xybz
6
vulnerability VCID-2mtb-mdha-qufv
7
vulnerability VCID-3hm3-htje-akgd
8
vulnerability VCID-434b-p73k-5fam
9
vulnerability VCID-4kym-jhtn-cfa3
10
vulnerability VCID-4xqq-69ab-1qew
11
vulnerability VCID-5732-ffyz-9fh5
12
vulnerability VCID-5bex-xcub-3qhr
13
vulnerability VCID-5nq8-gsav-5ffq
14
vulnerability VCID-68yp-31d3-zbay
15
vulnerability VCID-6yrk-8tj5-juhp
16
vulnerability VCID-8xx2-vtnr-dubu
17
vulnerability VCID-b24q-c9nx-hkdy
18
vulnerability VCID-by7b-2zr9-y3dj
19
vulnerability VCID-ca62-h2qv-v7bg
20
vulnerability VCID-ce9p-rwsz-zkf6
21
vulnerability VCID-cj4m-mvzh-ckh4
22
vulnerability VCID-d56y-s4zt-uyd7
23
vulnerability VCID-dvp1-5vf5-qfg9
24
vulnerability VCID-e5h2-wvws-3yhq
25
vulnerability VCID-ebzh-bpks-5qe2
26
vulnerability VCID-ej5y-geq1-pkfn
27
vulnerability VCID-evap-nt9g-akf6
28
vulnerability VCID-g41m-xvk2-xfda
29
vulnerability VCID-gaqh-vn1h-b3c1
30
vulnerability VCID-ggmh-6ef8-7ufj
31
vulnerability VCID-gyge-7d5c-6uhz
32
vulnerability VCID-hvpx-y297-sbha
33
vulnerability VCID-j3pc-gwg6-qfbs
34
vulnerability VCID-ksvn-b6hv-hfa7
35
vulnerability VCID-nhp5-61h7-ryf4
36
vulnerability VCID-patg-tmcj-3qbh
37
vulnerability VCID-pf71-p73a-xyda
38
vulnerability VCID-qks2-mqk8-wffq
39
vulnerability VCID-qy5u-7m7g-4ben
40
vulnerability VCID-r363-kggk-k3ds
41
vulnerability VCID-rns1-e6pd-tkex
42
vulnerability VCID-s86p-ew9a-rkgt
43
vulnerability VCID-sw28-urg9-tqgd
44
vulnerability VCID-tf5n-etq9-2bg1
45
vulnerability VCID-turp-jxv8-1fgy
46
vulnerability VCID-v633-mycj-6uh6
47
vulnerability VCID-w7z4-h1ug-z3cq
48
vulnerability VCID-wpqk-8fd9-p3ex
49
vulnerability VCID-wzj5-ba9k-q3at
50
vulnerability VCID-xn1n-5rgc-83bg
51
vulnerability VCID-y1wd-arvg-2ugt
52
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.36
1
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-292m-hgvs-93ey
4
vulnerability VCID-2bcr-bxek-skfq
5
vulnerability VCID-2dra-x6f5-xybz
6
vulnerability VCID-2mtb-mdha-qufv
7
vulnerability VCID-3hm3-htje-akgd
8
vulnerability VCID-434b-p73k-5fam
9
vulnerability VCID-4kym-jhtn-cfa3
10
vulnerability VCID-4xqq-69ab-1qew
11
vulnerability VCID-5732-ffyz-9fh5
12
vulnerability VCID-5bex-xcub-3qhr
13
vulnerability VCID-5nq8-gsav-5ffq
14
vulnerability VCID-68yp-31d3-zbay
15
vulnerability VCID-6yrk-8tj5-juhp
16
vulnerability VCID-8xx2-vtnr-dubu
17
vulnerability VCID-b24q-c9nx-hkdy
18
vulnerability VCID-brjh-tyur-ebc8
19
vulnerability VCID-by7b-2zr9-y3dj
20
vulnerability VCID-ca62-h2qv-v7bg
21
vulnerability VCID-ce9p-rwsz-zkf6
22
vulnerability VCID-d56y-s4zt-uyd7
23
vulnerability VCID-dvp1-5vf5-qfg9
24
vulnerability VCID-e5h2-wvws-3yhq
25
vulnerability VCID-ebzh-bpks-5qe2
26
vulnerability VCID-ej5y-geq1-pkfn
27
vulnerability VCID-evap-nt9g-akf6
28
vulnerability VCID-g41m-xvk2-xfda
29
vulnerability VCID-gaqh-vn1h-b3c1
30
vulnerability VCID-ggmh-6ef8-7ufj
31
vulnerability VCID-gyge-7d5c-6uhz
32
vulnerability VCID-hvpx-y297-sbha
33
vulnerability VCID-j3pc-gwg6-qfbs
34
vulnerability VCID-ksvn-b6hv-hfa7
35
vulnerability VCID-mbd8-z3ry-cqap
36
vulnerability VCID-mf9a-eusx-f3gb
37
vulnerability VCID-nhp5-61h7-ryf4
38
vulnerability VCID-patg-tmcj-3qbh
39
vulnerability VCID-pf71-p73a-xyda
40
vulnerability VCID-qy5u-7m7g-4ben
41
vulnerability VCID-r363-kggk-k3ds
42
vulnerability VCID-rns1-e6pd-tkex
43
vulnerability VCID-s86p-ew9a-rkgt
44
vulnerability VCID-sw28-urg9-tqgd
45
vulnerability VCID-tf5n-etq9-2bg1
46
vulnerability VCID-turp-jxv8-1fgy
47
vulnerability VCID-uun9-ctyg-k3d9
48
vulnerability VCID-v633-mycj-6uh6
49
vulnerability VCID-w7z4-h1ug-z3cq
50
vulnerability VCID-wpqk-8fd9-p3ex
51
vulnerability VCID-xn1n-5rgc-83bg
52
vulnerability VCID-xn3y-rrkc-7bcz
53
vulnerability VCID-y1wd-arvg-2ugt
54
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48
aliases CVE-2022-42125, GHSA-g8hp-rc67-jf96
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mgw3-28sj-juh7
37
url VCID-msd2-mccp-z7cv
vulnerability_id VCID-msd2-mccp-z7cv
summary 
Liferay Portal Missing Authorization vulnerability
The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation.
references
0
reference_url http://liferay.com
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T18:55:52Z/
url http://liferay.com
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-39975
reference_id
reference_type
scores
0
value 0.00157
scoring_system epss
scoring_elements 0.36372
published_at 2026-06-06T12:55:00Z
1
value 0.00157
scoring_system epss
scoring_elements 0.36269
published_at 2026-06-04T12:55:00Z
2
value 0.00157
scoring_system epss
scoring_elements 0.36363
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-39975
2
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-39975
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-39975
4
reference_url https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-39975
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T18:55:52Z/
url https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-39975
5
reference_url https://github.com/advisories/GHSA-83qx-288m-72w4
reference_id GHSA-83qx-288m-72w4
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-83qx-288m-72w4
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.35
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.35
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-292m-hgvs-93ey
4
vulnerability VCID-2bcr-bxek-skfq
5
vulnerability VCID-2dra-x6f5-xybz
6
vulnerability VCID-2mtb-mdha-qufv
7
vulnerability VCID-434b-p73k-5fam
8
vulnerability VCID-4kym-jhtn-cfa3
9
vulnerability VCID-4xqq-69ab-1qew
10
vulnerability VCID-5732-ffyz-9fh5
11
vulnerability VCID-5bex-xcub-3qhr
12
vulnerability VCID-5nq8-gsav-5ffq
13
vulnerability VCID-68yp-31d3-zbay
14
vulnerability VCID-6yrk-8tj5-juhp
15
vulnerability VCID-8xx2-vtnr-dubu
16
vulnerability VCID-b24q-c9nx-hkdy
17
vulnerability VCID-by7b-2zr9-y3dj
18
vulnerability VCID-ca62-h2qv-v7bg
19
vulnerability VCID-ce9p-rwsz-zkf6
20
vulnerability VCID-cj4m-mvzh-ckh4
21
vulnerability VCID-d56y-s4zt-uyd7
22
vulnerability VCID-dvp1-5vf5-qfg9
23
vulnerability VCID-e5h2-wvws-3yhq
24
vulnerability VCID-ebzh-bpks-5qe2
25
vulnerability VCID-ej5y-geq1-pkfn
26
vulnerability VCID-evap-nt9g-akf6
27
vulnerability VCID-g41m-xvk2-xfda
28
vulnerability VCID-gaqh-vn1h-b3c1
29
vulnerability VCID-ggmh-6ef8-7ufj
30
vulnerability VCID-gyge-7d5c-6uhz
31
vulnerability VCID-hvpx-y297-sbha
32
vulnerability VCID-j3pc-gwg6-qfbs
33
vulnerability VCID-ksvn-b6hv-hfa7
34
vulnerability VCID-mgw3-28sj-juh7
35
vulnerability VCID-nhp5-61h7-ryf4
36
vulnerability VCID-patg-tmcj-3qbh
37
vulnerability VCID-pf71-p73a-xyda
38
vulnerability VCID-qks2-mqk8-wffq
39
vulnerability VCID-qy5u-7m7g-4ben
40
vulnerability VCID-r363-kggk-k3ds
41
vulnerability VCID-rns1-e6pd-tkex
42
vulnerability VCID-s86p-ew9a-rkgt
43
vulnerability VCID-sw28-urg9-tqgd
44
vulnerability VCID-tf5n-etq9-2bg1
45
vulnerability VCID-turp-jxv8-1fgy
46
vulnerability VCID-v633-mycj-6uh6
47
vulnerability VCID-w7z4-h1ug-z3cq
48
vulnerability VCID-wpqk-8fd9-p3ex
49
vulnerability VCID-wzj5-ba9k-q3at
50
vulnerability VCID-xn1n-5rgc-83bg
51
vulnerability VCID-y1wd-arvg-2ugt
52
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.35
aliases CVE-2022-39975, GHSA-83qx-288m-72w4
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-msd2-mccp-z7cv
38
url VCID-nhp5-61h7-ryf4
vulnerability_id VCID-nhp5-61h7-ryf4
summary 
Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43735
reference_id
reference_type
scores
0
value 0.0007
scoring_system epss
scoring_elements 0.21664
published_at 2026-06-05T12:55:00Z
1
value 0.0007
scoring_system epss
scoring_elements 0.2165
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43735
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/64d19e457ffc9876fd159a907741618843d7aadb
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/64d19e457ffc9876fd159a907741618843d7aadb
3
reference_url https://liferay.atlassian.net/browse/LPE-18158
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-18158
4
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43735
reference_id CVE-2025-43735
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-12T13:31:05Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43735
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43735
reference_id CVE-2025-43735
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43735
6
reference_url https://github.com/advisories/GHSA-222w-xmc5-jhp3
reference_id GHSA-222w-xmc5-jhp3
reference_type
scores
url https://github.com/advisories/GHSA-222w-xmc5-jhp3
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-27a1-teqk-cbe2
1
vulnerability VCID-2dra-x6f5-xybz
2
vulnerability VCID-434b-p73k-5fam
3
vulnerability VCID-4kym-jhtn-cfa3
4
vulnerability VCID-4xqq-69ab-1qew
5
vulnerability VCID-8xx2-vtnr-dubu
6
vulnerability VCID-by7b-2zr9-y3dj
7
vulnerability VCID-ca62-h2qv-v7bg
8
vulnerability VCID-evap-nt9g-akf6
9
vulnerability VCID-g41m-xvk2-xfda
10
vulnerability VCID-ggmh-6ef8-7ufj
11
vulnerability VCID-gyge-7d5c-6uhz
12
vulnerability VCID-j3pc-gwg6-qfbs
13
vulnerability VCID-ksvn-b6hv-hfa7
14
vulnerability VCID-s86p-ew9a-rkgt
15
vulnerability VCID-u1pr-9cpx-q3hg
16
vulnerability VCID-w7z4-h1ug-z3cq
17
vulnerability VCID-wpqk-8fd9-p3ex
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132
aliases CVE-2025-43735, GHSA-222w-xmc5-jhp3
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nhp5-61h7-ryf4
39
url VCID-patg-tmcj-3qbh
vulnerability_id VCID-patg-tmcj-3qbh
summary 
Liferay portal has unauthorized access to object definition via search
The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching for the object definition.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-33947
reference_id
reference_type
scores
0
value 0.00268
scoring_system epss
scoring_elements 0.50528
published_at 2026-06-05T12:55:00Z
1
value 0.00268
scoring_system epss
scoring_elements 0.50535
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-33947
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33947
reference_id CVE-2023-33947
reference_type
scores
0
value 2.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
1
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-22T15:44:18Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33947
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-33947
reference_id CVE-2023-33947
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-33947
4
reference_url https://github.com/advisories/GHSA-769c-p92r-xgxj
reference_id GHSA-769c-p92r-xgxj
reference_type
scores
url https://github.com/advisories/GHSA-769c-p92r-xgxj
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.61
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.61
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-292m-hgvs-93ey
4
vulnerability VCID-2bcr-bxek-skfq
5
vulnerability VCID-2dra-x6f5-xybz
6
vulnerability VCID-2mtb-mdha-qufv
7
vulnerability VCID-3hm3-htje-akgd
8
vulnerability VCID-434b-p73k-5fam
9
vulnerability VCID-4kym-jhtn-cfa3
10
vulnerability VCID-4xqq-69ab-1qew
11
vulnerability VCID-5732-ffyz-9fh5
12
vulnerability VCID-5bex-xcub-3qhr
13
vulnerability VCID-5nq8-gsav-5ffq
14
vulnerability VCID-68yp-31d3-zbay
15
vulnerability VCID-6yrk-8tj5-juhp
16
vulnerability VCID-8xx2-vtnr-dubu
17
vulnerability VCID-b24q-c9nx-hkdy
18
vulnerability VCID-brjh-tyur-ebc8
19
vulnerability VCID-by7b-2zr9-y3dj
20
vulnerability VCID-ca62-h2qv-v7bg
21
vulnerability VCID-ce9p-rwsz-zkf6
22
vulnerability VCID-d56y-s4zt-uyd7
23
vulnerability VCID-dvp1-5vf5-qfg9
24
vulnerability VCID-e5h2-wvws-3yhq
25
vulnerability VCID-ebzh-bpks-5qe2
26
vulnerability VCID-ej5y-geq1-pkfn
27
vulnerability VCID-evap-nt9g-akf6
28
vulnerability VCID-g41m-xvk2-xfda
29
vulnerability VCID-gaqh-vn1h-b3c1
30
vulnerability VCID-ggmh-6ef8-7ufj
31
vulnerability VCID-gyge-7d5c-6uhz
32
vulnerability VCID-hvpx-y297-sbha
33
vulnerability VCID-j3pc-gwg6-qfbs
34
vulnerability VCID-ksvn-b6hv-hfa7
35
vulnerability VCID-mbd8-z3ry-cqap
36
vulnerability VCID-mf9a-eusx-f3gb
37
vulnerability VCID-nhp5-61h7-ryf4
38
vulnerability VCID-pf71-p73a-xyda
39
vulnerability VCID-qy5u-7m7g-4ben
40
vulnerability VCID-r363-kggk-k3ds
41
vulnerability VCID-rns1-e6pd-tkex
42
vulnerability VCID-s86p-ew9a-rkgt
43
vulnerability VCID-sw28-urg9-tqgd
44
vulnerability VCID-tf5n-etq9-2bg1
45
vulnerability VCID-turp-jxv8-1fgy
46
vulnerability VCID-uun9-ctyg-k3d9
47
vulnerability VCID-w7z4-h1ug-z3cq
48
vulnerability VCID-wpqk-8fd9-p3ex
49
vulnerability VCID-xn1n-5rgc-83bg
50
vulnerability VCID-y1wd-arvg-2ugt
51
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.61
aliases CVE-2023-33947, GHSA-769c-p92r-xgxj
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-patg-tmcj-3qbh
40
url VCID-pf71-p73a-xyda
vulnerability_id VCID-pf71-p73a-xyda
summary 
Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet
Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to access arbitrary CSS and JSS files and load the files multiple times via the query string in a URL.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43813
reference_id
reference_type
scores
0
value 0.00198
scoring_system epss
scoring_elements 0.41876
published_at 2026-06-06T12:55:00Z
1
value 0.00198
scoring_system epss
scoring_elements 0.41865
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43813
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/7acad68976e831a0f3b855752ad7874e03be1d43
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/7acad68976e831a0f3b855752ad7874e03be1d43
3
reference_url https://github.com/liferay/liferay-portal/commit/9159075ede8a1656bf67a893a486c93a9e9fe70a
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/9159075ede8a1656bf67a893a486c93a9e9fe70a
4
reference_url https://github.com/liferay/liferay-portal/commit/9be57d358ae0f6181a138ce08f52b80e4b14778a
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/9be57d358ae0f6181a138ce08f52b80e4b14778a
5
reference_url https://liferay.atlassian.net/browse/LPE-17865
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-17865
6
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43813
reference_id CVE-2025-43813
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-09-30T14:45:14Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43813
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43813
reference_id CVE-2025-43813
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43813
8
reference_url https://github.com/advisories/GHSA-2hm7-r8f3-423h
reference_id GHSA-2hm7-r8f3-423h
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-2hm7-r8f3-423h
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108-ga108
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108-ga108
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108-ga108
1
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-2bcr-bxek-skfq
4
vulnerability VCID-2dra-x6f5-xybz
5
vulnerability VCID-2mtb-mdha-qufv
6
vulnerability VCID-434b-p73k-5fam
7
vulnerability VCID-4kym-jhtn-cfa3
8
vulnerability VCID-4xqq-69ab-1qew
9
vulnerability VCID-5732-ffyz-9fh5
10
vulnerability VCID-8xx2-vtnr-dubu
11
vulnerability VCID-brjh-tyur-ebc8
12
vulnerability VCID-by7b-2zr9-y3dj
13
vulnerability VCID-ca62-h2qv-v7bg
14
vulnerability VCID-ce9p-rwsz-zkf6
15
vulnerability VCID-csnj-331s-43ea
16
vulnerability VCID-d56y-s4zt-uyd7
17
vulnerability VCID-ebzh-bpks-5qe2
18
vulnerability VCID-evap-nt9g-akf6
19
vulnerability VCID-g41m-xvk2-xfda
20
vulnerability VCID-ggmh-6ef8-7ufj
21
vulnerability VCID-gyge-7d5c-6uhz
22
vulnerability VCID-j3pc-gwg6-qfbs
23
vulnerability VCID-ksvn-b6hv-hfa7
24
vulnerability VCID-nhp5-61h7-ryf4
25
vulnerability VCID-qy5u-7m7g-4ben
26
vulnerability VCID-r363-kggk-k3ds
27
vulnerability VCID-rns1-e6pd-tkex
28
vulnerability VCID-s86p-ew9a-rkgt
29
vulnerability VCID-su57-hncy-5qg4
30
vulnerability VCID-sw28-urg9-tqgd
31
vulnerability VCID-w7z4-h1ug-z3cq
32
vulnerability VCID-wpqk-8fd9-p3ex
33
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
aliases CVE-2025-43813, GHSA-2hm7-r8f3-423h
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-pf71-p73a-xyda
41
url VCID-qks2-mqk8-wffq
vulnerability_id VCID-qks2-mqk8-wffq
summary 
Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-26269
reference_id
reference_type
scores
0
value 0.00147
scoring_system epss
scoring_elements 0.34843
published_at 2026-06-06T12:55:00Z
1
value 0.00147
scoring_system epss
scoring_elements 0.34827
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-26269
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 9.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26269
reference_id CVE-2024-26269
reference_type
scores
0
value 9.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-21T16:16:54Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26269
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-26269
reference_id CVE-2024-26269
reference_type
scores
0
value 9.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-26269
4
reference_url https://github.com/advisories/GHSA-rwhv-hvj2-qrqm
reference_id GHSA-rwhv-hvj2-qrqm
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-rwhv-hvj2-qrqm
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.38
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.38
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-292m-hgvs-93ey
4
vulnerability VCID-2bcr-bxek-skfq
5
vulnerability VCID-2dra-x6f5-xybz
6
vulnerability VCID-2mtb-mdha-qufv
7
vulnerability VCID-3hm3-htje-akgd
8
vulnerability VCID-434b-p73k-5fam
9
vulnerability VCID-4kym-jhtn-cfa3
10
vulnerability VCID-4xqq-69ab-1qew
11
vulnerability VCID-5732-ffyz-9fh5
12
vulnerability VCID-5bex-xcub-3qhr
13
vulnerability VCID-5nq8-gsav-5ffq
14
vulnerability VCID-68yp-31d3-zbay
15
vulnerability VCID-6yrk-8tj5-juhp
16
vulnerability VCID-8xx2-vtnr-dubu
17
vulnerability VCID-b24q-c9nx-hkdy
18
vulnerability VCID-by7b-2zr9-y3dj
19
vulnerability VCID-ca62-h2qv-v7bg
20
vulnerability VCID-ce9p-rwsz-zkf6
21
vulnerability VCID-cj4m-mvzh-ckh4
22
vulnerability VCID-d56y-s4zt-uyd7
23
vulnerability VCID-dvp1-5vf5-qfg9
24
vulnerability VCID-e5h2-wvws-3yhq
25
vulnerability VCID-ebzh-bpks-5qe2
26
vulnerability VCID-ej5y-geq1-pkfn
27
vulnerability VCID-evap-nt9g-akf6
28
vulnerability VCID-g41m-xvk2-xfda
29
vulnerability VCID-gaqh-vn1h-b3c1
30
vulnerability VCID-ggmh-6ef8-7ufj
31
vulnerability VCID-gyge-7d5c-6uhz
32
vulnerability VCID-hvpx-y297-sbha
33
vulnerability VCID-j3pc-gwg6-qfbs
34
vulnerability VCID-ksvn-b6hv-hfa7
35
vulnerability VCID-nhp5-61h7-ryf4
36
vulnerability VCID-patg-tmcj-3qbh
37
vulnerability VCID-pf71-p73a-xyda
38
vulnerability VCID-qy5u-7m7g-4ben
39
vulnerability VCID-r363-kggk-k3ds
40
vulnerability VCID-rns1-e6pd-tkex
41
vulnerability VCID-s86p-ew9a-rkgt
42
vulnerability VCID-sw28-urg9-tqgd
43
vulnerability VCID-tf5n-etq9-2bg1
44
vulnerability VCID-turp-jxv8-1fgy
45
vulnerability VCID-v633-mycj-6uh6
46
vulnerability VCID-w7z4-h1ug-z3cq
47
vulnerability VCID-wpqk-8fd9-p3ex
48
vulnerability VCID-wzj5-ba9k-q3at
49
vulnerability VCID-xn1n-5rgc-83bg
50
vulnerability VCID-y1wd-arvg-2ugt
51
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.38
aliases CVE-2024-26269, GHSA-rwhv-hvj2-qrqm
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qks2-mqk8-wffq
42
url VCID-qrgm-94me-83hz
vulnerability_id VCID-qrgm-94me-83hz
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-33940
reference_id
reference_type
scores
0
value 0.00259
scoring_system epss
scoring_elements 0.49564
published_at 2026-06-05T12:55:00Z
1
value 0.00259
scoring_system epss
scoring_elements 0.49574
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-33940
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940
reference_id CVE-2023-33940
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-22T15:45:34Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-33940
reference_id CVE-2023-33940
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-33940
4
reference_url https://github.com/advisories/GHSA-x82q-mr23-27jc
reference_id GHSA-x82q-mr23-27jc
reference_type
scores
url https://github.com/advisories/GHSA-x82q-mr23-27jc
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.31
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.31
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-292m-hgvs-93ey
4
vulnerability VCID-2bcr-bxek-skfq
5
vulnerability VCID-2dra-x6f5-xybz
6
vulnerability VCID-2mtb-mdha-qufv
7
vulnerability VCID-434b-p73k-5fam
8
vulnerability VCID-4kym-jhtn-cfa3
9
vulnerability VCID-4xqq-69ab-1qew
10
vulnerability VCID-5732-ffyz-9fh5
11
vulnerability VCID-5bex-xcub-3qhr
12
vulnerability VCID-5nq8-gsav-5ffq
13
vulnerability VCID-68yp-31d3-zbay
14
vulnerability VCID-6yrk-8tj5-juhp
15
vulnerability VCID-8xx2-vtnr-dubu
16
vulnerability VCID-b24q-c9nx-hkdy
17
vulnerability VCID-by7b-2zr9-y3dj
18
vulnerability VCID-ca62-h2qv-v7bg
19
vulnerability VCID-ce9p-rwsz-zkf6
20
vulnerability VCID-cj4m-mvzh-ckh4
21
vulnerability VCID-d56y-s4zt-uyd7
22
vulnerability VCID-dvp1-5vf5-qfg9
23
vulnerability VCID-e5h2-wvws-3yhq
24
vulnerability VCID-ebzh-bpks-5qe2
25
vulnerability VCID-ej5y-geq1-pkfn
26
vulnerability VCID-evap-nt9g-akf6
27
vulnerability VCID-g41m-xvk2-xfda
28
vulnerability VCID-gaqh-vn1h-b3c1
29
vulnerability VCID-ggmh-6ef8-7ufj
30
vulnerability VCID-gyge-7d5c-6uhz
31
vulnerability VCID-hvpx-y297-sbha
32
vulnerability VCID-j3pc-gwg6-qfbs
33
vulnerability VCID-ksvn-b6hv-hfa7
34
vulnerability VCID-mgw3-28sj-juh7
35
vulnerability VCID-msd2-mccp-z7cv
36
vulnerability VCID-nhp5-61h7-ryf4
37
vulnerability VCID-patg-tmcj-3qbh
38
vulnerability VCID-pf71-p73a-xyda
39
vulnerability VCID-qks2-mqk8-wffq
40
vulnerability VCID-qy5u-7m7g-4ben
41
vulnerability VCID-r363-kggk-k3ds
42
vulnerability VCID-rns1-e6pd-tkex
43
vulnerability VCID-s86p-ew9a-rkgt
44
vulnerability VCID-sw28-urg9-tqgd
45
vulnerability VCID-tf5n-etq9-2bg1
46
vulnerability VCID-turp-jxv8-1fgy
47
vulnerability VCID-v633-mycj-6uh6
48
vulnerability VCID-w7z4-h1ug-z3cq
49
vulnerability VCID-wpqk-8fd9-p3ex
50
vulnerability VCID-wzj5-ba9k-q3at
51
vulnerability VCID-xn1n-5rgc-83bg
52
vulnerability VCID-y1wd-arvg-2ugt
53
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.31
aliases CVE-2023-33940, GHSA-x82q-mr23-27jc
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qrgm-94me-83hz
43
url VCID-qy5u-7m7g-4ben
vulnerability_id VCID-qy5u-7m7g-4ben
summary 
Liferay Portal is vulnerable to XSS through its Commerce Search Result widget
Cross-site Scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Commerce Product's Name text field.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43823
reference_id
reference_type
scores
0
value 0.00031
scoring_system epss
scoring_elements 0.09263
published_at 2026-06-06T12:55:00Z
1
value 0.00031
scoring_system epss
scoring_elements 0.09244
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43823
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43823
reference_id CVE-2025-43823
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-08T13:40:14Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43823
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43823
reference_id CVE-2025-43823
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43823
4
reference_url https://github.com/advisories/GHSA-xx7h-2wf7-hc7p
reference_id GHSA-xx7h-2wf7-hc7p
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-xx7h-2wf7-hc7p
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-27a1-teqk-cbe2
1
vulnerability VCID-2bcr-bxek-skfq
2
vulnerability VCID-2dra-x6f5-xybz
3
vulnerability VCID-2mtb-mdha-qufv
4
vulnerability VCID-434b-p73k-5fam
5
vulnerability VCID-4kym-jhtn-cfa3
6
vulnerability VCID-4xqq-69ab-1qew
7
vulnerability VCID-8xx2-vtnr-dubu
8
vulnerability VCID-brjh-tyur-ebc8
9
vulnerability VCID-by7b-2zr9-y3dj
10
vulnerability VCID-ca62-h2qv-v7bg
11
vulnerability VCID-csnj-331s-43ea
12
vulnerability VCID-ebzh-bpks-5qe2
13
vulnerability VCID-evap-nt9g-akf6
14
vulnerability VCID-g41m-xvk2-xfda
15
vulnerability VCID-ggmh-6ef8-7ufj
16
vulnerability VCID-gyge-7d5c-6uhz
17
vulnerability VCID-j3pc-gwg6-qfbs
18
vulnerability VCID-ksvn-b6hv-hfa7
19
vulnerability VCID-nhp5-61h7-ryf4
20
vulnerability VCID-rns1-e6pd-tkex
21
vulnerability VCID-s86p-ew9a-rkgt
22
vulnerability VCID-sw28-urg9-tqgd
23
vulnerability VCID-w7z4-h1ug-z3cq
24
vulnerability VCID-wpqk-8fd9-p3ex
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
aliases CVE-2025-43823, GHSA-xx7h-2wf7-hc7p
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qy5u-7m7g-4ben
44
url VCID-r363-kggk-k3ds
vulnerability_id VCID-r363-kggk-k3ds
summary 
Liferay Portal is vulnerable to XSS in the Blogs widget
Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted <iframe> injected into a blog entry's “Content” text field.

The Blogs widget in Liferay DXP does not add the sandbox attribute to <iframe> elements, which allows remote attackers to access the parent page via scripts and links in the frame page.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-62265
reference_id
reference_type
scores
0
value 0.00031
scoring_system epss
scoring_elements 0.09263
published_at 2026-06-06T12:55:00Z
1
value 0.00031
scoring_system epss
scoring_elements 0.09244
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-62265
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62265
reference_id CVE-2025-62265
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-30T19:04:40Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62265
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-62265
reference_id CVE-2025-62265
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-62265
4
reference_url https://github.com/advisories/GHSA-56jv-4ww3-65mw
reference_id GHSA-56jv-4ww3-65mw
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-56jv-4ww3-65mw
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-27a1-teqk-cbe2
1
vulnerability VCID-2bcr-bxek-skfq
2
vulnerability VCID-2dra-x6f5-xybz
3
vulnerability VCID-2mtb-mdha-qufv
4
vulnerability VCID-434b-p73k-5fam
5
vulnerability VCID-4kym-jhtn-cfa3
6
vulnerability VCID-4xqq-69ab-1qew
7
vulnerability VCID-8xx2-vtnr-dubu
8
vulnerability VCID-brjh-tyur-ebc8
9
vulnerability VCID-by7b-2zr9-y3dj
10
vulnerability VCID-ca62-h2qv-v7bg
11
vulnerability VCID-csnj-331s-43ea
12
vulnerability VCID-ebzh-bpks-5qe2
13
vulnerability VCID-evap-nt9g-akf6
14
vulnerability VCID-g41m-xvk2-xfda
15
vulnerability VCID-ggmh-6ef8-7ufj
16
vulnerability VCID-gyge-7d5c-6uhz
17
vulnerability VCID-j3pc-gwg6-qfbs
18
vulnerability VCID-ksvn-b6hv-hfa7
19
vulnerability VCID-nhp5-61h7-ryf4
20
vulnerability VCID-rns1-e6pd-tkex
21
vulnerability VCID-s86p-ew9a-rkgt
22
vulnerability VCID-sw28-urg9-tqgd
23
vulnerability VCID-w7z4-h1ug-z3cq
24
vulnerability VCID-wpqk-8fd9-p3ex
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
aliases CVE-2025-62265, GHSA-56jv-4ww3-65mw
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-r363-kggk-k3ds
45
url VCID-rns1-e6pd-tkex
vulnerability_id VCID-rns1-e6pd-tkex
summary 
Liferay Portal Vulnerable to XSS in Web Content translation
Stored Cross-site Scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allow remote attackers to inject arbitrary web script or HTML via any rich text field in a web content article.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43826
reference_id
reference_type
scores
0
value 0.00033
scoring_system epss
scoring_elements 0.10198
published_at 2026-06-06T12:55:00Z
1
value 0.00033
scoring_system epss
scoring_elements 0.10177
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43826
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.atlassian.net/browse/LPE-17939
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-17939
3
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43826
reference_id CVE-2025-43826
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-01T15:03:14Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43826
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43826
reference_id CVE-2025-43826
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43826
5
reference_url https://github.com/advisories/GHSA-qh92-cr5f-3595
reference_id GHSA-qh92-cr5f-3595
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-qh92-cr5f-3595
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.113-ga113
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.113-ga113
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.113-ga113
1
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-27a1-teqk-cbe2
1
vulnerability VCID-2dra-x6f5-xybz
2
vulnerability VCID-2mtb-mdha-qufv
3
vulnerability VCID-434b-p73k-5fam
4
vulnerability VCID-4kym-jhtn-cfa3
5
vulnerability VCID-4xqq-69ab-1qew
6
vulnerability VCID-8xx2-vtnr-dubu
7
vulnerability VCID-brjh-tyur-ebc8
8
vulnerability VCID-by7b-2zr9-y3dj
9
vulnerability VCID-ca62-h2qv-v7bg
10
vulnerability VCID-csnj-331s-43ea
11
vulnerability VCID-ebzh-bpks-5qe2
12
vulnerability VCID-evap-nt9g-akf6
13
vulnerability VCID-g41m-xvk2-xfda
14
vulnerability VCID-ggmh-6ef8-7ufj
15
vulnerability VCID-gyge-7d5c-6uhz
16
vulnerability VCID-j3pc-gwg6-qfbs
17
vulnerability VCID-ksvn-b6hv-hfa7
18
vulnerability VCID-nhp5-61h7-ryf4
19
vulnerability VCID-s86p-ew9a-rkgt
20
vulnerability VCID-sw28-urg9-tqgd
21
vulnerability VCID-w7z4-h1ug-z3cq
22
vulnerability VCID-wpqk-8fd9-p3ex
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120
aliases CVE-2025-43826, GHSA-qh92-cr5f-3595
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-rns1-e6pd-tkex
46
url VCID-s86p-ew9a-rkgt
vulnerability_id VCID-s86p-ew9a-rkgt
summary 
Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability
A Denial Of Service via File Upload (DOS) vulnerability in Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload a profile picture of more than 300kb into a user profile. This size is more than the noted max 300kb size. This extra data can significantly slow down the Liferay service.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43736
reference_id
reference_type
scores
0
value 0.00236
scoring_system epss
scoring_elements 0.46783
published_at 2026-06-06T12:55:00Z
1
value 0.00236
scoring_system epss
scoring_elements 0.4678
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43736
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/RE:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/ab8932bee29df7df377c468f662d55e624d9390d
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/RE:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/ab8932bee29df7df377c468f662d55e624d9390d
3
reference_url https://liferay.atlassian.net/browse/LPE-18220
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/RE:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-18220
4
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43736
reference_id CVE-2025-43736
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/RE:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-12T18:15:44Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43736
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43736
reference_id CVE-2025-43736
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/RE:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43736
6
reference_url https://github.com/advisories/GHSA-cg99-m88x-422c
reference_id GHSA-cg99-m88x-422c
reference_type
scores
url https://github.com/advisories/GHSA-cg99-m88x-422c
fixed_packages
aliases CVE-2025-43736, GHSA-cg99-m88x-422c
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-s86p-ew9a-rkgt
47
url VCID-sw28-urg9-tqgd
vulnerability_id VCID-sw28-urg9-tqgd
summary 
Liferay Portal and Liferay DXP Reveals Data via Forms
The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 allows an unauthorized user to obtain entry data from forms.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-2565
reference_id
reference_type
scores
0
value 0.00356
scoring_system epss
scoring_elements 0.5821
published_at 2026-06-06T12:55:00Z
1
value 0.00356
scoring_system epss
scoring_elements 0.58201
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-2565
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2025-2565
reference_id CVE-2025-2565
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-20T17:53:33Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2025-2565
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-2565
reference_id CVE-2025-2565
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-2565
4
reference_url https://github.com/advisories/GHSA-9fcg-wrp8-qhr4
reference_id GHSA-9fcg-wrp8-qhr4
reference_type
scores
url https://github.com/advisories/GHSA-9fcg-wrp8-qhr4
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.129
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.129
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-27a1-teqk-cbe2
1
vulnerability VCID-2dra-x6f5-xybz
2
vulnerability VCID-434b-p73k-5fam
3
vulnerability VCID-4kym-jhtn-cfa3
4
vulnerability VCID-4xqq-69ab-1qew
5
vulnerability VCID-8xx2-vtnr-dubu
6
vulnerability VCID-by7b-2zr9-y3dj
7
vulnerability VCID-ca62-h2qv-v7bg
8
vulnerability VCID-ebzh-bpks-5qe2
9
vulnerability VCID-evap-nt9g-akf6
10
vulnerability VCID-g41m-xvk2-xfda
11
vulnerability VCID-ggmh-6ef8-7ufj
12
vulnerability VCID-gyge-7d5c-6uhz
13
vulnerability VCID-j3pc-gwg6-qfbs
14
vulnerability VCID-ksvn-b6hv-hfa7
15
vulnerability VCID-nhp5-61h7-ryf4
16
vulnerability VCID-s86p-ew9a-rkgt
17
vulnerability VCID-u1pr-9cpx-q3hg
18
vulnerability VCID-w7z4-h1ug-z3cq
19
vulnerability VCID-wpqk-8fd9-p3ex
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.129
aliases CVE-2025-2565, GHSA-9fcg-wrp8-qhr4
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-sw28-urg9-tqgd
48
url VCID-tf5n-etq9-2bg1
vulnerability_id VCID-tf5n-etq9-2bg1
summary 
Liferay Portal Does Not Limit Access to APIs Before Email Verification
Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified their email address, which allows remote users to access and edit content via the API.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-62259
reference_id
reference_type
scores
0
value 0.00057
scoring_system epss
scoring_elements 0.18117
published_at 2026-06-06T12:55:00Z
1
value 0.00057
scoring_system epss
scoring_elements 0.18115
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-62259
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62259
reference_id CVE-2025-62259
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-28T19:47:44Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62259
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-62259
reference_id CVE-2025-62259
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-62259
4
reference_url https://github.com/advisories/GHSA-gv7w-jh8g-vr73
reference_id GHSA-gv7w-jh8g-vr73
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-gv7w-jh8g-vr73
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110
1
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-2bcr-bxek-skfq
4
vulnerability VCID-2dra-x6f5-xybz
5
vulnerability VCID-2mtb-mdha-qufv
6
vulnerability VCID-434b-p73k-5fam
7
vulnerability VCID-4kym-jhtn-cfa3
8
vulnerability VCID-4xqq-69ab-1qew
9
vulnerability VCID-5732-ffyz-9fh5
10
vulnerability VCID-8xx2-vtnr-dubu
11
vulnerability VCID-brjh-tyur-ebc8
12
vulnerability VCID-by7b-2zr9-y3dj
13
vulnerability VCID-ca62-h2qv-v7bg
14
vulnerability VCID-ce9p-rwsz-zkf6
15
vulnerability VCID-csnj-331s-43ea
16
vulnerability VCID-d56y-s4zt-uyd7
17
vulnerability VCID-ebzh-bpks-5qe2
18
vulnerability VCID-evap-nt9g-akf6
19
vulnerability VCID-g41m-xvk2-xfda
20
vulnerability VCID-ggmh-6ef8-7ufj
21
vulnerability VCID-gyge-7d5c-6uhz
22
vulnerability VCID-j3pc-gwg6-qfbs
23
vulnerability VCID-ksvn-b6hv-hfa7
24
vulnerability VCID-nhp5-61h7-ryf4
25
vulnerability VCID-qy5u-7m7g-4ben
26
vulnerability VCID-r363-kggk-k3ds
27
vulnerability VCID-rns1-e6pd-tkex
28
vulnerability VCID-s86p-ew9a-rkgt
29
vulnerability VCID-su57-hncy-5qg4
30
vulnerability VCID-sw28-urg9-tqgd
31
vulnerability VCID-w7z4-h1ug-z3cq
32
vulnerability VCID-wpqk-8fd9-p3ex
33
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
aliases CVE-2025-62259, GHSA-gv7w-jh8g-vr73
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-tf5n-etq9-2bg1
49
url VCID-turp-jxv8-1fgy
vulnerability_id VCID-turp-jxv8-1fgy
summary 
Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console
The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability. This issue has been patched in Liferay Portal 7.4.3.102, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.0, Liferay DXP 2023.Q3.5, and Liferay DXP 7.3 Update 36.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-8980
reference_id
reference_type
scores
0
value 0.00381
scoring_system epss
scoring_elements 0.59889
published_at 2026-06-05T12:55:00Z
1
value 0.00381
scoring_system epss
scoring_elements 0.59892
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-8980
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 9.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980
reference_id CVE-2024-8980
reference_type
scores
0
value 9.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:02:17Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-8980
reference_id CVE-2024-8980
reference_type
scores
0
value 9.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-8980
4
reference_url https://github.com/advisories/GHSA-chj2-4vg7-hhg3
reference_id GHSA-chj2-4vg7-hhg3
reference_type
scores
url https://github.com/advisories/GHSA-chj2-4vg7-hhg3
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.102-GA102
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.102-GA102
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.102-GA102
1
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-2bcr-bxek-skfq
4
vulnerability VCID-2dra-x6f5-xybz
5
vulnerability VCID-2mtb-mdha-qufv
6
vulnerability VCID-3hm3-htje-akgd
7
vulnerability VCID-434b-p73k-5fam
8
vulnerability VCID-4kym-jhtn-cfa3
9
vulnerability VCID-4xqq-69ab-1qew
10
vulnerability VCID-5732-ffyz-9fh5
11
vulnerability VCID-5bex-xcub-3qhr
12
vulnerability VCID-68yp-31d3-zbay
13
vulnerability VCID-6yrk-8tj5-juhp
14
vulnerability VCID-8xx2-vtnr-dubu
15
vulnerability VCID-brjh-tyur-ebc8
16
vulnerability VCID-by7b-2zr9-y3dj
17
vulnerability VCID-ca62-h2qv-v7bg
18
vulnerability VCID-ce9p-rwsz-zkf6
19
vulnerability VCID-csnj-331s-43ea
20
vulnerability VCID-d56y-s4zt-uyd7
21
vulnerability VCID-ebzh-bpks-5qe2
22
vulnerability VCID-evap-nt9g-akf6
23
vulnerability VCID-g41m-xvk2-xfda
24
vulnerability VCID-ggmh-6ef8-7ufj
25
vulnerability VCID-gyge-7d5c-6uhz
26
vulnerability VCID-hvpx-y297-sbha
27
vulnerability VCID-j3pc-gwg6-qfbs
28
vulnerability VCID-ksvn-b6hv-hfa7
29
vulnerability VCID-nhp5-61h7-ryf4
30
vulnerability VCID-pf71-p73a-xyda
31
vulnerability VCID-qy5u-7m7g-4ben
32
vulnerability VCID-r363-kggk-k3ds
33
vulnerability VCID-rns1-e6pd-tkex
34
vulnerability VCID-rs2y-3c75-uycm
35
vulnerability VCID-s86p-ew9a-rkgt
36
vulnerability VCID-su57-hncy-5qg4
37
vulnerability VCID-sw28-urg9-tqgd
38
vulnerability VCID-tf5n-etq9-2bg1
39
vulnerability VCID-w7z4-h1ug-z3cq
40
vulnerability VCID-wpqk-8fd9-p3ex
41
vulnerability VCID-y1wd-arvg-2ugt
42
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103
aliases CVE-2024-8980, GHSA-chj2-4vg7-hhg3
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-turp-jxv8-1fgy
50
url VCID-v633-mycj-6uh6
vulnerability_id VCID-v633-mycj-6uh6
summary 
Liferay portal unauthorized access to objects via OAuth 2 scope
The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-33946
reference_id
reference_type
scores
0
value 0.00277
scoring_system epss
scoring_elements 0.51445
published_at 2026-06-05T12:55:00Z
1
value 0.00277
scoring_system epss
scoring_elements 0.51452
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-33946
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33946
reference_id CVE-2023-33946
reference_type
scores
0
value 2.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
1
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-22T15:44:36Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33946
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-33946
reference_id CVE-2023-33946
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-33946
4
reference_url https://github.com/advisories/GHSA-2868-ff44-43qv
reference_id GHSA-2868-ff44-43qv
reference_type
scores
url https://github.com/advisories/GHSA-2868-ff44-43qv
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.49
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.49
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-292m-hgvs-93ey
4
vulnerability VCID-2bcr-bxek-skfq
5
vulnerability VCID-2dra-x6f5-xybz
6
vulnerability VCID-2mtb-mdha-qufv
7
vulnerability VCID-3hm3-htje-akgd
8
vulnerability VCID-434b-p73k-5fam
9
vulnerability VCID-4kym-jhtn-cfa3
10
vulnerability VCID-4xqq-69ab-1qew
11
vulnerability VCID-5732-ffyz-9fh5
12
vulnerability VCID-5bex-xcub-3qhr
13
vulnerability VCID-5nq8-gsav-5ffq
14
vulnerability VCID-68yp-31d3-zbay
15
vulnerability VCID-6yrk-8tj5-juhp
16
vulnerability VCID-8xx2-vtnr-dubu
17
vulnerability VCID-b24q-c9nx-hkdy
18
vulnerability VCID-brjh-tyur-ebc8
19
vulnerability VCID-by7b-2zr9-y3dj
20
vulnerability VCID-ca62-h2qv-v7bg
21
vulnerability VCID-ce9p-rwsz-zkf6
22
vulnerability VCID-d56y-s4zt-uyd7
23
vulnerability VCID-dvp1-5vf5-qfg9
24
vulnerability VCID-e5h2-wvws-3yhq
25
vulnerability VCID-ebzh-bpks-5qe2
26
vulnerability VCID-ej5y-geq1-pkfn
27
vulnerability VCID-evap-nt9g-akf6
28
vulnerability VCID-g41m-xvk2-xfda
29
vulnerability VCID-gaqh-vn1h-b3c1
30
vulnerability VCID-ggmh-6ef8-7ufj
31
vulnerability VCID-gyge-7d5c-6uhz
32
vulnerability VCID-hvpx-y297-sbha
33
vulnerability VCID-j3pc-gwg6-qfbs
34
vulnerability VCID-ksvn-b6hv-hfa7
35
vulnerability VCID-mbd8-z3ry-cqap
36
vulnerability VCID-mf9a-eusx-f3gb
37
vulnerability VCID-nhp5-61h7-ryf4
38
vulnerability VCID-patg-tmcj-3qbh
39
vulnerability VCID-pf71-p73a-xyda
40
vulnerability VCID-qy5u-7m7g-4ben
41
vulnerability VCID-r363-kggk-k3ds
42
vulnerability VCID-rns1-e6pd-tkex
43
vulnerability VCID-s86p-ew9a-rkgt
44
vulnerability VCID-sw28-urg9-tqgd
45
vulnerability VCID-tf5n-etq9-2bg1
46
vulnerability VCID-turp-jxv8-1fgy
47
vulnerability VCID-uun9-ctyg-k3d9
48
vulnerability VCID-w7z4-h1ug-z3cq
49
vulnerability VCID-wpqk-8fd9-p3ex
50
vulnerability VCID-xn1n-5rgc-83bg
51
vulnerability VCID-xn3y-rrkc-7bcz
52
vulnerability VCID-y1wd-arvg-2ugt
53
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.49
aliases CVE-2023-33946, GHSA-2868-ff44-43qv
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-v633-mycj-6uh6
51
url VCID-w7z4-h1ug-z3cq
vulnerability_id VCID-w7z4-h1ug-z3cq
summary 
Liferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition Parameter
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43757
reference_id
reference_type
scores
0
value 0.00041
scoring_system epss
scoring_elements 0.1269
published_at 2026-06-06T12:55:00Z
1
value 0.00041
scoring_system epss
scoring_elements 0.12686
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43757
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/0114bb60238e5ac74b90fba37fa9748c4e6c114a
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/0114bb60238e5ac74b90fba37fa9748c4e6c114a
3
reference_url https://github.com/liferay/liferay-portal/commit/0837982b91c5f9e837ec11a93f7e0986e00738fa
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/0837982b91c5f9e837ec11a93f7e0986e00738fa
4
reference_url https://github.com/liferay/liferay-portal/commit/45492d30bad4084f36e87ef11c29a5bf5fb4046d
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/45492d30bad4084f36e87ef11c29a5bf5fb4046d
5
reference_url https://github.com/liferay/liferay-portal/commit/90396a201d05be5840f99f7487578aab253dfa87
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/90396a201d05be5840f99f7487578aab253dfa87
6
reference_url https://github.com/liferay/liferay-portal/commit/9e0026c8aa444937a2bfd079bcca35ab3dd18f5a
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/9e0026c8aa444937a2bfd079bcca35ab3dd18f5a
7
reference_url https://github.com/liferay/liferay-portal/commit/cc46176ba4142f470d540f2343b36f12a678a240
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/cc46176ba4142f470d540f2343b36f12a678a240
8
reference_url https://github.com/liferay/liferay-portal/commit/d001c5ba8a1477755d7d83b8a00aba23036b045b
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/d001c5ba8a1477755d7d83b8a00aba23036b045b
9
reference_url https://github.com/liferay/liferay-portal/commit/e83d102bf00af3aa4396c1fc5a1d6b3842ccaeb1
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/e83d102bf00af3aa4396c1fc5a1d6b3842ccaeb1
10
reference_url https://liferay.atlassian.net/browse/LPE-18259
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-18259
11
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43757
reference_id CVE-2025-43757
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T20:00:20Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43757
12
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43757
reference_id CVE-2025-43757
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43757
13
reference_url https://github.com/advisories/GHSA-62pf-hcwj-rcfc
reference_id GHSA-62pf-hcwj-rcfc
reference_type
scores
url https://github.com/advisories/GHSA-62pf-hcwj-rcfc
fixed_packages
aliases CVE-2025-43757, GHSA-62pf-hcwj-rcfc
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-w7z4-h1ug-z3cq
52
url VCID-wpqk-8fd9-p3ex
vulnerability_id VCID-wpqk-8fd9-p3ex
summary 
Liferay Portal Unauthenticated File Access via URL
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded in the form and stored in document_library.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43749
reference_id
reference_type
scores
0
value 0.0013
scoring_system epss
scoring_elements 0.32039
published_at 2026-06-05T12:55:00Z
1
value 0.00141
scoring_system epss
scoring_elements 0.34026
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43749
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/5919534a979a97444172f49705b7a224e372e625
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/5919534a979a97444172f49705b7a224e372e625
3
reference_url https://github.com/liferay/liferay-portal/commit/b88e7e0912d27cc166fc788b642616ece9e8c484
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/b88e7e0912d27cc166fc788b642616ece9e8c484
4
reference_url https://liferay.atlassian.net/browse/LPE-18176
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.atlassian.net/browse/LPE-18176
5
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43749
reference_id CVE-2025-43749
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T15:12:36Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43749
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43749
reference_id CVE-2025-43749
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43749
7
reference_url https://github.com/advisories/GHSA-5fx5-cff6-f3fp
reference_id GHSA-5fx5-cff6-f3fp
reference_type
scores
url https://github.com/advisories/GHSA-5fx5-cff6-f3fp
fixed_packages
aliases CVE-2025-43749, GHSA-5fx5-cff6-f3fp
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wpqk-8fd9-p3ex
53
url VCID-wzj5-ba9k-q3at
vulnerability_id VCID-wzj5-ba9k-q3at
summary 
Incorrect Default Permissions in Liferay Portal
The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page.
references
0
reference_url http://liferay.com
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:27:47Z/
url http://liferay.com
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-42127
reference_id
reference_type
scores
0
value 0.00186
scoring_system epss
scoring_elements 0.40266
published_at 2026-06-06T12:55:00Z
1
value 0.00186
scoring_system epss
scoring_elements 0.40181
published_at 2026-06-04T12:55:00Z
2
value 0.00186
scoring_system epss
scoring_elements 0.40263
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-42127
2
reference_url https://issues.liferay.com/browse/LPE-17607
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:27:47Z/
url https://issues.liferay.com/browse/LPE-17607
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-42127
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-42127
4
reference_url https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42127
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:27:47Z/
url https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42127
5
reference_url https://github.com/advisories/GHSA-5x9h-p2gx-35mg
reference_id GHSA-5x9h-p2gx-35mg
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-5x9h-p2gx-35mg
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-292m-hgvs-93ey
4
vulnerability VCID-2bcr-bxek-skfq
5
vulnerability VCID-2dra-x6f5-xybz
6
vulnerability VCID-2mtb-mdha-qufv
7
vulnerability VCID-3hm3-htje-akgd
8
vulnerability VCID-434b-p73k-5fam
9
vulnerability VCID-4kym-jhtn-cfa3
10
vulnerability VCID-4xqq-69ab-1qew
11
vulnerability VCID-5732-ffyz-9fh5
12
vulnerability VCID-5bex-xcub-3qhr
13
vulnerability VCID-5nq8-gsav-5ffq
14
vulnerability VCID-68yp-31d3-zbay
15
vulnerability VCID-6yrk-8tj5-juhp
16
vulnerability VCID-8xx2-vtnr-dubu
17
vulnerability VCID-b24q-c9nx-hkdy
18
vulnerability VCID-brjh-tyur-ebc8
19
vulnerability VCID-by7b-2zr9-y3dj
20
vulnerability VCID-ca62-h2qv-v7bg
21
vulnerability VCID-ce9p-rwsz-zkf6
22
vulnerability VCID-d56y-s4zt-uyd7
23
vulnerability VCID-dvp1-5vf5-qfg9
24
vulnerability VCID-e5h2-wvws-3yhq
25
vulnerability VCID-ebzh-bpks-5qe2
26
vulnerability VCID-ej5y-geq1-pkfn
27
vulnerability VCID-evap-nt9g-akf6
28
vulnerability VCID-g41m-xvk2-xfda
29
vulnerability VCID-gaqh-vn1h-b3c1
30
vulnerability VCID-ggmh-6ef8-7ufj
31
vulnerability VCID-gyge-7d5c-6uhz
32
vulnerability VCID-hvpx-y297-sbha
33
vulnerability VCID-j3pc-gwg6-qfbs
34
vulnerability VCID-ksvn-b6hv-hfa7
35
vulnerability VCID-mbd8-z3ry-cqap
36
vulnerability VCID-mf9a-eusx-f3gb
37
vulnerability VCID-nhp5-61h7-ryf4
38
vulnerability VCID-patg-tmcj-3qbh
39
vulnerability VCID-pf71-p73a-xyda
40
vulnerability VCID-qy5u-7m7g-4ben
41
vulnerability VCID-r363-kggk-k3ds
42
vulnerability VCID-rns1-e6pd-tkex
43
vulnerability VCID-s86p-ew9a-rkgt
44
vulnerability VCID-sw28-urg9-tqgd
45
vulnerability VCID-tf5n-etq9-2bg1
46
vulnerability VCID-turp-jxv8-1fgy
47
vulnerability VCID-uun9-ctyg-k3d9
48
vulnerability VCID-v633-mycj-6uh6
49
vulnerability VCID-w7z4-h1ug-z3cq
50
vulnerability VCID-wpqk-8fd9-p3ex
51
vulnerability VCID-xn1n-5rgc-83bg
52
vulnerability VCID-xn3y-rrkc-7bcz
53
vulnerability VCID-y1wd-arvg-2ugt
54
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48
aliases CVE-2022-42127, GHSA-5x9h-p2gx-35mg
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wzj5-ba9k-q3at
54
url VCID-xn1n-5rgc-83bg
vulnerability_id VCID-xn1n-5rgc-83bg
summary 
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_roles_admin_web_portlet_RolesAdminPortlet_tabs2` parameter.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-42496
reference_id
reference_type
scores
0
value 0.0044
scoring_system epss
scoring_elements 0.63563
published_at 2026-06-06T12:55:00Z
1
value 0.0044
scoring_system epss
scoring_elements 0.63556
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-42496
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 9.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42496
reference_id CVE-2023-42496
reference_type
scores
0
value 9.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T16:07:22Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42496
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-42496
reference_id CVE-2023-42496
reference_type
scores
0
value 9.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-42496
4
reference_url https://github.com/advisories/GHSA-54pv-r62j-9qqc
reference_id GHSA-54pv-r62j-9qqc
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-54pv-r62j-9qqc
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-292m-hgvs-93ey
4
vulnerability VCID-2bcr-bxek-skfq
5
vulnerability VCID-2dra-x6f5-xybz
6
vulnerability VCID-2mtb-mdha-qufv
7
vulnerability VCID-3hm3-htje-akgd
8
vulnerability VCID-434b-p73k-5fam
9
vulnerability VCID-4kym-jhtn-cfa3
10
vulnerability VCID-4xqq-69ab-1qew
11
vulnerability VCID-5732-ffyz-9fh5
12
vulnerability VCID-5bex-xcub-3qhr
13
vulnerability VCID-68yp-31d3-zbay
14
vulnerability VCID-6yrk-8tj5-juhp
15
vulnerability VCID-8xx2-vtnr-dubu
16
vulnerability VCID-b24q-c9nx-hkdy
17
vulnerability VCID-brjh-tyur-ebc8
18
vulnerability VCID-by7b-2zr9-y3dj
19
vulnerability VCID-ca62-h2qv-v7bg
20
vulnerability VCID-ce9p-rwsz-zkf6
21
vulnerability VCID-csnj-331s-43ea
22
vulnerability VCID-d56y-s4zt-uyd7
23
vulnerability VCID-ebzh-bpks-5qe2
24
vulnerability VCID-ej5y-geq1-pkfn
25
vulnerability VCID-evap-nt9g-akf6
26
vulnerability VCID-g41m-xvk2-xfda
27
vulnerability VCID-ggmh-6ef8-7ufj
28
vulnerability VCID-gyge-7d5c-6uhz
29
vulnerability VCID-hvpx-y297-sbha
30
vulnerability VCID-j3pc-gwg6-qfbs
31
vulnerability VCID-ksvn-b6hv-hfa7
32
vulnerability VCID-mbd8-z3ry-cqap
33
vulnerability VCID-nhp5-61h7-ryf4
34
vulnerability VCID-pf71-p73a-xyda
35
vulnerability VCID-qy5u-7m7g-4ben
36
vulnerability VCID-r363-kggk-k3ds
37
vulnerability VCID-rns1-e6pd-tkex
38
vulnerability VCID-rs2y-3c75-uycm
39
vulnerability VCID-s86p-ew9a-rkgt
40
vulnerability VCID-su57-hncy-5qg4
41
vulnerability VCID-sw28-urg9-tqgd
42
vulnerability VCID-tf5n-etq9-2bg1
43
vulnerability VCID-turp-jxv8-1fgy
44
vulnerability VCID-w7z4-h1ug-z3cq
45
vulnerability VCID-wpqk-8fd9-p3ex
46
vulnerability VCID-xv4h-g41b-c7c7
47
vulnerability VCID-y1wd-arvg-2ugt
48
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98
aliases CVE-2023-42496, GHSA-54pv-r62j-9qqc
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xn1n-5rgc-83bg
55
url VCID-y1wd-arvg-2ugt
vulnerability_id VCID-y1wd-arvg-2ugt
summary 
Liferay Portal is vulnerable to DNS rebinding attacks
By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated by changing the redirect URL security from IP to domain.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-62266
reference_id
reference_type
scores
0
value 0.00043
scoring_system epss
scoring_elements 0.13605
published_at 2026-06-06T12:55:00Z
1
value 0.00043
scoring_system epss
scoring_elements 0.136
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-62266
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62256
reference_id CVE-2025-62256
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-30T19:06:36Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62256
3
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257
reference_id CVE-2025-62257
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-62266
reference_id CVE-2025-62266
reference_type
scores
0
value 5.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-62266
5
reference_url https://github.com/advisories/GHSA-f5vh-4rj2-w8r8
reference_id GHSA-f5vh-4rj2-w8r8
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-f5vh-4rj2-w8r8
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110
1
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1jgz-k7zp-uydp
2
vulnerability VCID-27a1-teqk-cbe2
3
vulnerability VCID-2bcr-bxek-skfq
4
vulnerability VCID-2dra-x6f5-xybz
5
vulnerability VCID-2mtb-mdha-qufv
6
vulnerability VCID-434b-p73k-5fam
7
vulnerability VCID-4kym-jhtn-cfa3
8
vulnerability VCID-4xqq-69ab-1qew
9
vulnerability VCID-5732-ffyz-9fh5
10
vulnerability VCID-8xx2-vtnr-dubu
11
vulnerability VCID-brjh-tyur-ebc8
12
vulnerability VCID-by7b-2zr9-y3dj
13
vulnerability VCID-ca62-h2qv-v7bg
14
vulnerability VCID-ce9p-rwsz-zkf6
15
vulnerability VCID-csnj-331s-43ea
16
vulnerability VCID-d56y-s4zt-uyd7
17
vulnerability VCID-ebzh-bpks-5qe2
18
vulnerability VCID-evap-nt9g-akf6
19
vulnerability VCID-g41m-xvk2-xfda
20
vulnerability VCID-ggmh-6ef8-7ufj
21
vulnerability VCID-gyge-7d5c-6uhz
22
vulnerability VCID-j3pc-gwg6-qfbs
23
vulnerability VCID-ksvn-b6hv-hfa7
24
vulnerability VCID-nhp5-61h7-ryf4
25
vulnerability VCID-qy5u-7m7g-4ben
26
vulnerability VCID-r363-kggk-k3ds
27
vulnerability VCID-rns1-e6pd-tkex
28
vulnerability VCID-s86p-ew9a-rkgt
29
vulnerability VCID-su57-hncy-5qg4
30
vulnerability VCID-sw28-urg9-tqgd
31
vulnerability VCID-w7z4-h1ug-z3cq
32
vulnerability VCID-wpqk-8fd9-p3ex
33
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112
aliases CVE-2025-62266, GHSA-f5vh-4rj2-w8r8
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-y1wd-arvg-2ugt
56
url VCID-ynk1-3fye-bfcx
vulnerability_id VCID-ynk1-3fye-bfcx
summary 
Liferay Portal has multiple Stored XSS vulnerabilities on its View Order page
Multiple stored Cross-site Scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92 allow remote attackers to inject arbitrary web script or HTML via crafted payload injected into a Terms and Condition's Name text field to (1) Payment Terms, or (2) the Delivery Term on the view order page.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-43822
reference_id
reference_type
scores
0
value 0.00031
scoring_system epss
scoring_elements 0.09263
published_at 2026-06-06T12:55:00Z
1
value 0.00031
scoring_system epss
scoring_elements 0.09244
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-43822
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43822
reference_id CVE-2025-43822
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-08T14:34:11Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43822
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-43822
reference_id CVE-2025-43822
reference_type
scores
0
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-43822
4
reference_url https://github.com/advisories/GHSA-4mqx-4p8g-995w
reference_id GHSA-4mqx-4p8g-995w
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-4mqx-4p8g-995w
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-27a1-teqk-cbe2
1
vulnerability VCID-2bcr-bxek-skfq
2
vulnerability VCID-2dra-x6f5-xybz
3
vulnerability VCID-2mtb-mdha-qufv
4
vulnerability VCID-434b-p73k-5fam
5
vulnerability VCID-4kym-jhtn-cfa3
6
vulnerability VCID-4xqq-69ab-1qew
7
vulnerability VCID-8xx2-vtnr-dubu
8
vulnerability VCID-brjh-tyur-ebc8
9
vulnerability VCID-by7b-2zr9-y3dj
10
vulnerability VCID-ca62-h2qv-v7bg
11
vulnerability VCID-csnj-331s-43ea
12
vulnerability VCID-ebzh-bpks-5qe2
13
vulnerability VCID-evap-nt9g-akf6
14
vulnerability VCID-g41m-xvk2-xfda
15
vulnerability VCID-ggmh-6ef8-7ufj
16
vulnerability VCID-gyge-7d5c-6uhz
17
vulnerability VCID-j3pc-gwg6-qfbs
18
vulnerability VCID-ksvn-b6hv-hfa7
19
vulnerability VCID-nhp5-61h7-ryf4
20
vulnerability VCID-rns1-e6pd-tkex
21
vulnerability VCID-s86p-ew9a-rkgt
22
vulnerability VCID-sw28-urg9-tqgd
23
vulnerability VCID-w7z4-h1ug-z3cq
24
vulnerability VCID-wpqk-8fd9-p3ex
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112
aliases CVE-2025-43822, GHSA-4mqx-4p8g-995w
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ynk1-3fye-bfcx
Fixing_vulnerabilities
0
url VCID-e5c7-wsvb-dyfm
vulnerability_id VCID-e5c7-wsvb-dyfm
summary 
Liferay Portal and Liferay DXP HTTP Header Can Expose Versions
In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity` is set to `full`, which allows remote attackers to easily identify the version of the application that is running and the vulnerabilities that affect that version via 'Liferay-Portal` response header.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-26267
reference_id
reference_type
scores
0
value 0.00224
scoring_system epss
scoring_elements 0.45205
published_at 2026-06-06T12:55:00Z
1
value 0.00224
scoring_system epss
scoring_elements 0.45202
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-26267
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://github.com/liferay/liferay-portal/commit/00750dade0cc81efc380fcc6d7e2f58060c4ad95
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/00750dade0cc81efc380fcc6d7e2f58060c4ad95
3
reference_url https://github.com/liferay/liferay-portal/commit/0e881cac66db14a11673c0352def6df04f77d35c
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/0e881cac66db14a11673c0352def6df04f77d35c
4
reference_url https://github.com/liferay/liferay-portal/commit/9658cec331feaaaad8bf93c6f65e1768a1f43ae2
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal/commit/9658cec331feaaaad8bf93c6f65e1768a1f43ae2
5
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26267
reference_id CVE-2024-26267
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T15:20:52Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26267
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-26267
reference_id CVE-2024-26267
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-26267
7
reference_url https://github.com/advisories/GHSA-2mvj-q2q3-wxjv
reference_id GHSA-2mvj-q2q3-wxjv
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-2mvj-q2q3-wxjv
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.26-ga26
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.26-ga26
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.26-ga26
1
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1fqz-psdf-g7dm
2
vulnerability VCID-1jgz-k7zp-uydp
3
vulnerability VCID-27a1-teqk-cbe2
4
vulnerability VCID-292m-hgvs-93ey
5
vulnerability VCID-2bcr-bxek-skfq
6
vulnerability VCID-2dra-x6f5-xybz
7
vulnerability VCID-2mtb-mdha-qufv
8
vulnerability VCID-434b-p73k-5fam
9
vulnerability VCID-4kym-jhtn-cfa3
10
vulnerability VCID-4xqq-69ab-1qew
11
vulnerability VCID-5732-ffyz-9fh5
12
vulnerability VCID-5bex-xcub-3qhr
13
vulnerability VCID-5nq8-gsav-5ffq
14
vulnerability VCID-68yp-31d3-zbay
15
vulnerability VCID-6yrk-8tj5-juhp
16
vulnerability VCID-7tas-6nn4-9fhu
17
vulnerability VCID-8xx2-vtnr-dubu
18
vulnerability VCID-b24q-c9nx-hkdy
19
vulnerability VCID-by7b-2zr9-y3dj
20
vulnerability VCID-ca62-h2qv-v7bg
21
vulnerability VCID-ce9p-rwsz-zkf6
22
vulnerability VCID-cj4m-mvzh-ckh4
23
vulnerability VCID-d56y-s4zt-uyd7
24
vulnerability VCID-dvp1-5vf5-qfg9
25
vulnerability VCID-e5h2-wvws-3yhq
26
vulnerability VCID-ebzh-bpks-5qe2
27
vulnerability VCID-ej5y-geq1-pkfn
28
vulnerability VCID-evap-nt9g-akf6
29
vulnerability VCID-g41m-xvk2-xfda
30
vulnerability VCID-gaqh-vn1h-b3c1
31
vulnerability VCID-ggmh-6ef8-7ufj
32
vulnerability VCID-gyge-7d5c-6uhz
33
vulnerability VCID-hvpx-y297-sbha
34
vulnerability VCID-j3pc-gwg6-qfbs
35
vulnerability VCID-ksvn-b6hv-hfa7
36
vulnerability VCID-mgw3-28sj-juh7
37
vulnerability VCID-msd2-mccp-z7cv
38
vulnerability VCID-nhp5-61h7-ryf4
39
vulnerability VCID-patg-tmcj-3qbh
40
vulnerability VCID-pf71-p73a-xyda
41
vulnerability VCID-qks2-mqk8-wffq
42
vulnerability VCID-qrgm-94me-83hz
43
vulnerability VCID-qy5u-7m7g-4ben
44
vulnerability VCID-r363-kggk-k3ds
45
vulnerability VCID-rns1-e6pd-tkex
46
vulnerability VCID-s86p-ew9a-rkgt
47
vulnerability VCID-sw28-urg9-tqgd
48
vulnerability VCID-tf5n-etq9-2bg1
49
vulnerability VCID-turp-jxv8-1fgy
50
vulnerability VCID-v633-mycj-6uh6
51
vulnerability VCID-w7z4-h1ug-z3cq
52
vulnerability VCID-wpqk-8fd9-p3ex
53
vulnerability VCID-wzj5-ba9k-q3at
54
vulnerability VCID-xn1n-5rgc-83bg
55
vulnerability VCID-y1wd-arvg-2ugt
56
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27
aliases CVE-2024-26267, GHSA-2mvj-q2q3-wxjv
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-e5c7-wsvb-dyfm
1
url VCID-ggs5-4zac-vqa7
vulnerability_id VCID-ggs5-4zac-vqa7
summary 
Liferay Portal denial-of-service vulnerability
The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-25144
reference_id
reference_type
scores
0
value 0.00318
scoring_system epss
scoring_elements 0.55172
published_at 2026-06-06T12:55:00Z
1
value 0.00318
scoring_system epss
scoring_elements 0.55165
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-25144
1
reference_url https://github.com/liferay/liferay-portal
reference_id
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L
1
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/liferay/liferay-portal
2
reference_url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25144
reference_id CVE-2024-25144
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L
1
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-08T20:11:12Z/
url https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25144
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-25144
reference_id CVE-2024-25144
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L
1
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-25144
4
reference_url https://github.com/advisories/GHSA-w275-m8cr-hf2v
reference_id GHSA-w275-m8cr-hf2v
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-w275-m8cr-hf2v
fixed_packages
0
url pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27
purl pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-11qf-d5xp-4fey
1
vulnerability VCID-1fqz-psdf-g7dm
2
vulnerability VCID-1jgz-k7zp-uydp
3
vulnerability VCID-27a1-teqk-cbe2
4
vulnerability VCID-292m-hgvs-93ey
5
vulnerability VCID-2bcr-bxek-skfq
6
vulnerability VCID-2dra-x6f5-xybz
7
vulnerability VCID-2mtb-mdha-qufv
8
vulnerability VCID-434b-p73k-5fam
9
vulnerability VCID-4kym-jhtn-cfa3
10
vulnerability VCID-4xqq-69ab-1qew
11
vulnerability VCID-5732-ffyz-9fh5
12
vulnerability VCID-5bex-xcub-3qhr
13
vulnerability VCID-5nq8-gsav-5ffq
14
vulnerability VCID-68yp-31d3-zbay
15
vulnerability VCID-6yrk-8tj5-juhp
16
vulnerability VCID-7tas-6nn4-9fhu
17
vulnerability VCID-8xx2-vtnr-dubu
18
vulnerability VCID-b24q-c9nx-hkdy
19
vulnerability VCID-by7b-2zr9-y3dj
20
vulnerability VCID-ca62-h2qv-v7bg
21
vulnerability VCID-ce9p-rwsz-zkf6
22
vulnerability VCID-cj4m-mvzh-ckh4
23
vulnerability VCID-d56y-s4zt-uyd7
24
vulnerability VCID-dvp1-5vf5-qfg9
25
vulnerability VCID-e5h2-wvws-3yhq
26
vulnerability VCID-ebzh-bpks-5qe2
27
vulnerability VCID-ej5y-geq1-pkfn
28
vulnerability VCID-evap-nt9g-akf6
29
vulnerability VCID-g41m-xvk2-xfda
30
vulnerability VCID-gaqh-vn1h-b3c1
31
vulnerability VCID-ggmh-6ef8-7ufj
32
vulnerability VCID-gyge-7d5c-6uhz
33
vulnerability VCID-hvpx-y297-sbha
34
vulnerability VCID-j3pc-gwg6-qfbs
35
vulnerability VCID-ksvn-b6hv-hfa7
36
vulnerability VCID-mgw3-28sj-juh7
37
vulnerability VCID-msd2-mccp-z7cv
38
vulnerability VCID-nhp5-61h7-ryf4
39
vulnerability VCID-patg-tmcj-3qbh
40
vulnerability VCID-pf71-p73a-xyda
41
vulnerability VCID-qks2-mqk8-wffq
42
vulnerability VCID-qrgm-94me-83hz
43
vulnerability VCID-qy5u-7m7g-4ben
44
vulnerability VCID-r363-kggk-k3ds
45
vulnerability VCID-rns1-e6pd-tkex
46
vulnerability VCID-s86p-ew9a-rkgt
47
vulnerability VCID-sw28-urg9-tqgd
48
vulnerability VCID-tf5n-etq9-2bg1
49
vulnerability VCID-turp-jxv8-1fgy
50
vulnerability VCID-v633-mycj-6uh6
51
vulnerability VCID-w7z4-h1ug-z3cq
52
vulnerability VCID-wpqk-8fd9-p3ex
53
vulnerability VCID-wzj5-ba9k-q3at
54
vulnerability VCID-xn1n-5rgc-83bg
55
vulnerability VCID-y1wd-arvg-2ugt
56
vulnerability VCID-ynk1-3fye-bfcx
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27
aliases CVE-2024-25144, GHSA-w275-m8cr-hf2v
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ggs5-4zac-vqa7
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27