Search for packages
| purl | pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-wjfm-qxg2-q679
Aliases: CVE-2022-42119 |
Liferay Portal and Liferay DXP Vulnerable to XSS via the Commerce Module Certain Liferay products are vulnerable to Cross Site … |
Vulnerable |
|
GHSA-r5fj-j449-vqw2
Aliases: CVE-2022-42120 |
Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module A SQL injection vulnerability in the Fragment … |
Vulnerable |
|
GHSA-f43m-hhj4-q3jg
Aliases: CVE-2022-42132 |
Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL The Test LDAP Users functionality in Liferay Portal … |
Vulnerable |
|
GHSA-p768-r2m2-8vjr
Aliases: CVE-2022-42111 |
Liferay Portal and Liferay DXP Vulnerable to XSS via the Sharing Module A Cross-site scripting (XSS) vulnerability in the Sharing … |
Vulnerable |
|
GHSA-g6r2-6x46-jpp6
Aliases: CVE-2022-42117 |
Liferay Portal and Liferay DXP Vulnerable to XSS in the Frontend Taglib Module A Cross-site scripting (XSS) vulnerability in the … |
Vulnerable |
|
GHSA-7f7g-vhff-mjqj
Aliases: CVE-2022-42112 |
Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module A Cross-site scripting (XSS) vulnerability in the … |
Vulnerable |
|
GHSA-67jp-27jj-6x85
Aliases: CVE-2022-42116 |
Liferay Portal and Liferay DXP Vulnerable to XSS in the CKEditor Integration with the Frontend Editor Module A Cross-site scripting … |
Vulnerable |
|
GHSA-3vww-jrmm-9vff
Aliases: CVE-2022-26597 |
Liferay Portal and Liferay DXP allows arbitrary injection via the site name Cross-site scripting (XSS) vulnerability in the Layout module's … | There are no reported fixed by versions. |
|
GHSA-658f-xhv4-p978
Aliases: CVE-2022-26594 |
Liferay Portal and Liferay DXP allows arbitrary injection via form field Multiple cross-site scripting (XSS) vulnerabilities in Dynamic Data Mapping … | There are no reported fixed by versions. |
|
GHSA-822f-jfpg-hg7h
Aliases: CVE-2022-26595 |
Liferay Portal and Liferay DXP fails to check permissions to view sites/groups Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay … |
Vulnerable |
|
GHSA-q2rp-xfj8-r95h
Aliases: CVE-2022-26593 |
Liferay Portal and Liferay DXP allows arbitrary injection via the name of an asset category Cross-site scripting (XSS) vulnerability in … | There are no reported fixed by versions. |
|
GHSA-ghw5-998m-vw4w
Aliases: CVE-2022-25146 |
Liferay Portal and Liferay DXP fails to check origin of event messages The Remote App module before 2.0.21 from Liferay … |
Vulnerable |
|
GHSA-vw6g-gh6c-8qwp
Aliases: CVE-2021-38269 |
Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in the Gogo Shell module Cross-site scripting (XSS) vulnerability in … |
Vulnerable |
|
GHSA-f855-2rvm-5j7h
Aliases: CVE-2021-38268 |
Liferay Portal and Liferay DXP has incorrect default permissions for site members The Dynamic Data Mapping module before 4.0.39 from … |
Vulnerable |
|
GHSA-r39x-3qq4-gxmr
Aliases: CVE-2021-38267 |
Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in edit blog entry page Cross-site scripting (XSS) vulnerability in … |
Vulnerable |
|
GHSA-8mp9-w7gr-pvj3
Aliases: CVE-2022-28980 |
Liferay Portal and Liferay DXP Vulnerable to XSS via the filter_ Prefix Multiple cross-site scripting (XSS) vulnerabilities in Liferay Fragment … | There are no reported fixed by versions. |
|
GHSA-3mfq-fp2f-vwqh
Aliases: CVE-2024-38002 |
Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions The workflow component in Liferay Portal 7.3.2 through … |
Vulnerable |
|
GHSA-chj2-4vg7-hhg3
Aliases: CVE-2024-8980 |
Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console The Script Console in Liferay Portal 7.0.0 through … |
Vulnerable |
|
GHSA-px38-239g-x5mg
Aliases: CVE-2023-37940 |
Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page Cross-site scripting (XSS) vulnerability in … |
Vulnerable |
|
GHSA-4hxr-28mv-q729
Aliases: CVE-2024-11993 |
Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.1.0 through 7.4.3.38, … |
Vulnerable |
|
GHSA-xpjg-7hx7-wgcx
Aliases: CVE-2024-25147 |
Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through … |
Vulnerable |
|
GHSA-43h9-p3j4-39hm
Aliases: CVE-2024-25607 |
Liferay Portal defaults to a low work factor for the default password hashing algorithm The default password hashing algorithm (PBKDF2-HMAC-SHA1) … |
Vulnerable |
|
GHSA-qwj8-qgpr-8crm
Aliases: CVE-2024-25148 |
Liferay Portal vulnerable to user impersonation In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 … |
Vulnerable |
|
GHSA-44jg-jgjx-3xg5
Aliases: CVE-2024-25603 |
Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting Stored cross-site scripting (XSS) vulnerability … |
Vulnerable |
|
GHSA-cr36-3vqf-x5w5
Aliases: CVE-2024-25601 |
Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting Stored cross-site scripting (XSS) vulnerability in Expando module's … |
Vulnerable |
|
GHSA-mqf8-4cqm-p83x
Aliases: CVE-2024-25146 |
Liferay Portal allows attackers to discover the existence of sites Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and … |
Vulnerable |
|
GHSA-p28x-4r5h-ph6j
Aliases: CVE-2024-25152 |
Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting Stored cross-site scripting (XSS) vulnerability in Message … |
Vulnerable |
|
GHSA-hgr6-6hhw-883f
Aliases: CVE-2024-25151 |
Liferay Portal Calendar module and Liferay DXP vulnerable to Cross-site Scripting, content spoofing The Calendar module in Liferay Portal 7.2.0 … |
Vulnerable |
|
GHSA-2mvj-q2q3-wxjv
Aliases: CVE-2024-26267 |
Liferay Portal and Liferay DXP HTTP Header Can Expose Versions In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, … |
Vulnerable |
|
GHSA-4585-28v2-8h46
Aliases: CVE-2024-25150 |
Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel Information disclosure vulnerability in the Control Panel in … |
Vulnerable |
|
GHSA-869h-qhfx-w939
Aliases: CVE-2024-25606 |
Liferay Portal has an XXE vulnerability in Java2WsddTask._format XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, … |
Vulnerable |
|
GHSA-rwxc-4cmw-7x75
Aliases: CVE-2024-26266 |
Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 … |
Vulnerable |
|
GHSA-v2xq-m22w-jmpr
Aliases: CVE-2024-25602 |
Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting Stored cross-site scripting (XSS) vulnerability in Users … |
Vulnerable |
|
GHSA-548x-j6x6-hcv4
Aliases: CVE-2024-25608 |
Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement Character HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and … |
Vulnerable |
|
GHSA-qm43-g2xj-hvg5
Aliases: CVE-2024-26268 |
Liferay Portal and Liferay DXP User Enumeration Vulnerability User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported … |
Vulnerable |
|
GHSA-w275-m8cr-hf2v
Aliases: CVE-2024-25144 |
Liferay Portal denial-of-service vulnerability The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP … |
Vulnerable |
|
GHSA-vvpf-53qx-cxhh
Aliases: CVE-2024-25610 |
Liferay Portal has a Stored XSS with Blog entries (Insecure defaults) In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported … |
Vulnerable |
|
GHSA-9vgq-w5pv-v77q
Aliases: CVE-2024-25145 |
Liferay Portal stored cross-site scripting (XSS) vulnerability Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app … |
Vulnerable |
|
GHSA-qp68-5v39-r869
Aliases: CVE-2023-42627 |
Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module Multiple stored cross-site scripting (XSS) vulnerabilities in the … | There are no reported fixed by versions. |
|
GHSA-hv45-r2f5-fmhj
Aliases: CVE-2023-42628 |
Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget Stored cross-site scripting (XSS) vulnerability in the Wiki … |
Vulnerable |
|
GHSA-j5gv-w838-mmcx
Aliases: CVE-2023-44310 |
Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu Stored cross-site scripting (XSS) vulnerability in Page … | There are no reported fixed by versions. |
|
CVE-2025-3760
Aliases: GHSA-qhp6-vp7c-g7xp |
Liferay Cross-site Scripting vulnerability A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal … | There are no reported fixed by versions. |
|
GHSA-qhp6-vp7c-g7xp
Aliases: CVE-2025-3760 |
Liferay Cross-site Scripting vulnerability A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal … | There are no reported fixed by versions. |
|
GHSA-222w-xmc5-jhp3
Aliases: CVE-2025-43735 |
Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability A reflected cross-site scripting (XSS) vulnerability in the Liferay … | There are no reported fixed by versions. |
|
GHSA-cg99-m88x-422c
Aliases: CVE-2025-43736 |
Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability A Denial Of Service via … | There are no reported fixed by versions. |
|
GHSA-c6g5-g6r7-q4j6
Aliases: CVE-2025-4655 |
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery An SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 … | There are no reported fixed by versions. |
|
GHSA-m5c7-5gv3-hcpf
Aliases: CVE-2025-43734 |
Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability A reflected cross-site scripting (XSS) vulnerability in … |
Vulnerable Vulnerable |
|
GHSA-6v93-frf9-2rp8
Aliases: CVE-2025-4581 |
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through … | There are no reported fixed by versions. |
|
GHSA-7r3w-wggm-pjwf
Aliases: CVE-2022-28979 |
Liferay Portal and Liferay DXP Vulnerable to XSS in the Portal Search Module In Search Web before v6.0.19 in Liferay … | There are no reported fixed by versions. |
|
GHSA-54pv-r62j-9qqc
Aliases: CVE-2023-42496 |
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting Reflected cross-site scripting (XSS) vulnerability on the add assignees to … |
Vulnerable Vulnerable |
|
GHSA-rwhv-hvj2-qrqm
Aliases: CVE-2024-26269 |
Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting Cross-site scripting (XSS) vulnerability in the Frontend … |
Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-qcv4-gv43-498v
|
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via the Redirect's Admin Page Cross-site scripting (XSS) vulnerability in … |
CVE-2021-29045
|
|
GHSA-82j7-2h3j-hc7f
|
Liferay DXP Vulnerable to Denial-of-service (DoS) in the Multi-Factor Authentication Module Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in … |
CVE-2021-29041
|
|
GHSA-pr7v-qv65-rp9m
|
Liferay Portal and Liferay DXP Fails to Check Permissions The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and … |
CVE-2021-29052
|
|
GHSA-f9wj-c5pc-g9rh
|
Liferay Portal and Liferay DXP Vulnerable to Multiple SQL Injections Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay … |
CVE-2021-29053
|
|
GHSA-wcr5-3q96-c2gr
|
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Membership Request Admin Page Cross-site scripting (XSS) vulnerability in … |
CVE-2021-29044
|
|
GHSA-9mxg-p873-6793
|
Liferay Portal and Liferay DXP Fails to Invalidate CAPTCHA Answers After Use The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 … |
CVE-2021-29047
|
|
GHSA-9g57-m5vf-qp73
|
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Asset Module Parameter Cross-site scripting (XSS) vulnerability in the … |
CVE-2021-29046
|
|
GHSA-w28v-87g6-cjr6
|
Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via the currentURL Parameter Cross-site scripting (XSS) vulnerability in the Portal Workflow module's … |
CVE-2021-29049
|
|
GHSA-mwhf-6mjm-6w3h
|
Liferay Portal and Liferay DXP Does Not Obfuscate Password Reminder Answers In Liferay Impl before 5.18.4, Liferay Users Admin Web … |
CVE-2021-29038
|
|
GHSA-xx2h-2hf5-v7vv
|
Liferay Portal and Liferay DXP May Reveal S3 Store's Proxy Password The Portal Store module in Liferay Portal 7.0.0 through … |
CVE-2021-29043
|
|
GHSA-4fx8-82f3-xcpc
|
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in the Layout Admin Page Cross-site scripting (XSS) vulnerability in … |
CVE-2021-29048
|
|
GHSA-jvvx-8g42-9559
|
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Asset Publisher App Cross-site scripting (XSS) vulnerability in the … |
CVE-2021-29051
|