Search for packages
| purl | pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.3 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-vgqx-447m-wvcj
Aliases: CVE-2025-62260 |
Liferay Portal Vulnerable to DoS via Crafted Headless API Request Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through … |
Vulnerable |
|
GHSA-f5vh-4rj2-w8r8
Aliases: CVE-2025-62266 |
Liferay Portal is vulnerable to DNS rebinding attacks By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and … | There are no reported fixed by versions. |
|
GHSA-378f-8q54-3fqx
Aliases: CVE-2025-43830 |
Liferay Portal is vulnerable to Stored XSS through Forms text type field Stored cross-site scripting (XSS) vulnerability in Forms in … |
Vulnerable |
|
GHSA-xx7h-2wf7-hc7p
Aliases: CVE-2025-43823 |
Liferay Portal is vulnerable to XSS through its Commerce Search Result widget Cross-site Scripting (XSS) vulnerability in the Commerce Search … |
Vulnerable |
|
GHSA-qh92-cr5f-3595
Aliases: CVE-2025-43826 |
Liferay Portal Vulnerable to XSS in Web Content translation Stored Cross-site Scripting (XSS) vulnerabilities in Web Content translation in Liferay … | There are no reported fixed by versions. |
|
GHSA-gv7w-jh8g-vr73
Aliases: CVE-2025-62259 |
Liferay Portal Does Not Limit Access to APIs Before Email Verification Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, … | There are no reported fixed by versions. |
|
GHSA-xcj6-xpjg-c4xr
Aliases: CVE-2025-62261 |
Liferay Portal Stores Password Reset Tokens in Plain Text Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay … |
Vulnerable |
|
GHSA-pfxj-gvqg-mj44
Aliases: CVE-2025-43824 |
Liferay Profile Widget does not prevent vCard extension spoofing The Profile Widget in Liferay Portal 7.4.0 through 7.4.3.111, and older … |
Vulnerable |
|
GHSA-gh4w-8qgq-8w9r
Aliases: CVE-2025-62258 |
Liferay Portal Vulnerable to CSRF in Headless APIs CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and … | There are no reported fixed by versions. |
|
GHSA-56jv-4ww3-65mw
Aliases: CVE-2025-62265 |
Liferay Portal is vulnerable to XSS in the Blogs widget Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay … |
Vulnerable |
|
GHSA-8hw3-ghwv-crfh
Aliases: CVE-2025-62257 |
Liferay Portal vulnerable to password enumeration Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and … |
Vulnerable |
|
GHSA-2j97-4jmq-c4xf
Aliases: CVE-2025-62264 |
Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay … |
Vulnerable |
|
GHSA-62pf-hcwj-rcfc
Aliases: CVE-2025-43757 |
Liferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition Parameter A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 … | There are no reported fixed by versions. |
|
GHSA-g4vp-4gqr-7v8c
Aliases: CVE-2025-43743 |
Liferay Portal Enumeration Discrepancy in Calendars Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, … | There are no reported fixed by versions. |
|
GHSA-5fx5-cff6-f3fp
Aliases: CVE-2025-43749 |
Liferay Portal Unauthenticated File Access via URL Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through … | There are no reported fixed by versions. |
|
GHSA-mpww-r37c-vxjw
Aliases: CVE-2025-43746 |
Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal … | There are no reported fixed by versions. |
|
GHSA-m49p-6cjp-x2h3
Aliases: CVE-2025-43744 |
Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay … | There are no reported fixed by versions. |
|
GHSA-x7p4-v8mj-6fxx
Aliases: CVE-2025-43754 |
Liferay Portal Username Enumeration Vulnerability Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, … | There are no reported fixed by versions. |
|
GHSA-g4wg-mpfg-x2q6
Aliases: CVE-2025-3639 |
Liferay Portal Login Bypass Vulnerability Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 … | There are no reported fixed by versions. |
|
GHSA-fvqv-593q-qp8r
Aliases: CVE-2025-43760 |
Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through … | There are no reported fixed by versions. |
|
GHSA-qpp6-f3qj-rggq
Aliases: CVE-2025-43752 |
Liferay Portal's Unlimited File Upload Could Result in DoS Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, … | There are no reported fixed by versions. |
|
GHSA-3p2m-574v-v257
Aliases: CVE-2025-43731 |
Liferay Portal Vulnerable to Cross-Site Scripting A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and … | There are no reported fixed by versions. |
|
GHSA-j6p8-g3rj-ghpm
Aliases: CVE-2025-43741 |
Liferay Portal Vulnerable to Cross-Site Scripting via assetTagNames Parameter A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 … | There are no reported fixed by versions. |
|
GHSA-p9gc-59hf-x48p
Aliases: CVE-2025-43748 |
Liferay Portal Vulnerable to Cross-Site Request Forgery Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and … | There are no reported fixed by versions. |
|
GHSA-7q33-gwcm-r6cj
Aliases: CVE-2025-43745 |
Liferay Portal CSRF Vulnerability via Endpoint Parameter A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 … | There are no reported fixed by versions. |
|
GHSA-9fcg-wrp8-qhr4
Aliases: CVE-2025-2565 |
Liferay Portal and Liferay DXP Reveals Data via Forms The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and … |
Vulnerable |
|
GHSA-43xf-59vr-g4f2
Aliases: CVE-2025-43799 |
Liferay Portal Uses Default Password Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through … |
Vulnerable |
|
GHSA-hffx-r282-w2g9
Aliases: CVE-2022-42123 |
Path Traversal in Liferay Portal A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and … |
Vulnerable |
|
GHSA-83qx-288m-72w4
Aliases: CVE-2022-39975 |
Liferay Portal Missing Authorization vulnerability The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update … |
Vulnerable |
|
GHSA-3mfq-fp2f-vwqh
Aliases: CVE-2024-38002 |
Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions The workflow component in Liferay Portal 7.3.2 through … |
Vulnerable |
|
GHSA-chj2-4vg7-hhg3
Aliases: CVE-2024-8980 |
Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console The Script Console in Liferay Portal 7.0.0 through … | There are no reported fixed by versions. |
|
GHSA-px38-239g-x5mg
Aliases: CVE-2023-37940 |
Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page Cross-site scripting (XSS) vulnerability in … |
Vulnerable |
|
GHSA-4hxr-28mv-q729
Aliases: CVE-2024-11993 |
Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.1.0 through 7.4.3.38, … |
Vulnerable |
|
GHSA-mc8m-4r3w-q2hw
Aliases: CVE-2022-45320 |
Privilege escalation in Liferay Portal Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update … |
Vulnerable |
|
GHSA-29xx-fhff-36m7
Aliases: CVE-2024-26265 |
Liferay Portal vulnerable to Denial of Service The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported … |
Vulnerable |
|
GHSA-2mvj-q2q3-wxjv
Aliases: CVE-2024-26267 |
Liferay Portal and Liferay DXP HTTP Header Can Expose Versions In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, … | There are no reported fixed by versions. |
|
GHSA-548x-j6x6-hcv4
Aliases: CVE-2024-25608 |
Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement Character HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and … | There are no reported fixed by versions. |
|
GHSA-qm43-g2xj-hvg5
Aliases: CVE-2024-26268 |
Liferay Portal and Liferay DXP User Enumeration Vulnerability User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported … | There are no reported fixed by versions. |
|
GHSA-w275-m8cr-hf2v
Aliases: CVE-2024-25144 |
Liferay Portal denial-of-service vulnerability The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP … |
Vulnerable |
|
GHSA-769c-p92r-xgxj
Aliases: CVE-2023-33947 |
Liferay portal has unauthorized access to object definition via search The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and … |
Vulnerable |
|
GHSA-g7vw-43xg-8m4h
Aliases: CVE-2023-33945 |
SQL injection in Liferay Portal SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through … |
Vulnerable |
|
GHSA-x82q-mr23-27jc
Aliases: CVE-2023-33940 |
Cross-site scripting in Liferay Portal Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, … |
Vulnerable |
|
GHSA-2868-ff44-43qv
Aliases: CVE-2023-33946 |
Liferay portal unauthorized access to objects via OAuth 2 scope The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and … |
Vulnerable |
|
GHSA-pfwc-4frf-4gf8
Aliases: CVE-2023-33944 |
Cross-site scripting in Liferay Portal Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay … |
Vulnerable |
|
CVE-2022-42127
Aliases: GHSA-5x9h-p2gx-35mg |
Incorrect Default Permissions in Liferay Portal The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 … |
Vulnerable |
|
CVE-2025-43813
Aliases: GHSA-2hm7-r8f3-423h |
Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet Possible path traversal vulnerability and denial-of-service in the ComboServlet … | There are no reported fixed by versions. |
|
CVE-2025-43735
Aliases: GHSA-222w-xmc5-jhp3 |
Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability A reflected cross-site scripting (XSS) vulnerability in the Liferay … |
Vulnerable Vulnerable |
|
CVE-2025-43812
Aliases: GHSA-jv8x-mm3v-75r7 |
Liferay Portal vulnerable to cross-site scripting in the web content template Cross-site scripting (XSS) vulnerability in web content template in … |
Vulnerable Vulnerable |
|
GHSA-qhp6-vp7c-g7xp
Aliases: CVE-2025-3760 |
Liferay Cross-site Scripting vulnerability A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal … |
Vulnerable Vulnerable |
|
GHSA-222w-xmc5-jhp3
Aliases: CVE-2025-43735 |
Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability A reflected cross-site scripting (XSS) vulnerability in the Liferay … |
Vulnerable Vulnerable |
|
GHSA-cg99-m88x-422c
Aliases: CVE-2025-43736 |
Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability A Denial Of Service via … | There are no reported fixed by versions. |
|
GHSA-c6g5-g6r7-q4j6
Aliases: CVE-2025-4655 |
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery An SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 … | There are no reported fixed by versions. |
|
GHSA-m5c7-5gv3-hcpf
Aliases: CVE-2025-43734 |
Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability A reflected cross-site scripting (XSS) vulnerability in … | There are no reported fixed by versions. |
|
GHSA-6v93-frf9-2rp8
Aliases: CVE-2025-4581 |
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through … | There are no reported fixed by versions. |
|
GHSA-jv8x-mm3v-75r7
Aliases: CVE-2025-43812 |
Liferay Portal vulnerable to cross-site scripting in the web content template Cross-site scripting (XSS) vulnerability in web content template in … |
Vulnerable Vulnerable |
|
GHSA-2hm7-r8f3-423h
Aliases: CVE-2025-43813 |
Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet Possible path traversal vulnerability and denial-of-service in the ComboServlet … | There are no reported fixed by versions. |
|
GHSA-rcc7-jx7p-hrv4
Aliases: CVE-2025-43776 |
Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting A stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 … | There are no reported fixed by versions. |
|
GHSA-642h-mx8q-47p2
Aliases: CVE-2022-42126 |
Missing permissions check in Liferay Portal The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 … |
Vulnerable Vulnerable |
|
GHSA-g8hp-rc67-jf96
Aliases: CVE-2022-42125 |
Path Traversal in Liferay Portal Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 … |
Vulnerable Vulnerable |
|
GHSA-5x9h-p2gx-35mg
Aliases: CVE-2022-42127 |
Incorrect Default Permissions in Liferay Portal The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 … |
Vulnerable Vulnerable |
|
GHSA-p63m-vmjr-wg37
Aliases: CVE-2024-26272 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor Cross-site request forgery (CSRF) … | There are no reported fixed by versions. |
|
GHSA-hmrx-6pr5-hpwj
Aliases: CVE-2024-26273 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor Cross-site request forgery (CSRF) … |
Vulnerable Vulnerable |
|
GHSA-73x3-8mrg-5r93
Aliases: CVE-2023-42498 |
Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting Reflected cross-site scripting (XSS) vulnerability in … |
Vulnerable Vulnerable |
|
GHSA-54pv-r62j-9qqc
Aliases: CVE-2023-42496 |
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting Reflected cross-site scripting (XSS) vulnerability on the add assignees to … |
Vulnerable Vulnerable |
|
GHSA-rwhv-hvj2-qrqm
Aliases: CVE-2024-26269 |
Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting Cross-site scripting (XSS) vulnerability in the Frontend … |
Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-43h9-p3j4-39hm
|
Liferay Portal defaults to a low work factor for the default password hashing algorithm The default password hashing algorithm (PBKDF2-HMAC-SHA1) … |
CVE-2024-25607
|
|
GHSA-rwxc-4cmw-7x75
|
Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 … |
CVE-2024-26266
|