Search for packages
| purl | pkg:maven/com.liferay.portal/release.portal.bom@7.4.0-ga1 |
| Tags | Ghost |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 3.2 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-vgqx-447m-wvcj
Aliases: CVE-2025-62260 |
Liferay Portal Vulnerable to DoS via Crafted Headless API Request Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through … |
Vulnerable |
|
GHSA-f5vh-4rj2-w8r8
Aliases: CVE-2025-62266 |
Liferay Portal is vulnerable to DNS rebinding attacks By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and … | There are no reported fixed by versions. |
|
GHSA-qh92-cr5f-3595
Aliases: CVE-2025-43826 |
Liferay Portal Vulnerable to XSS in Web Content translation Stored Cross-site Scripting (XSS) vulnerabilities in Web Content translation in Liferay … | There are no reported fixed by versions. |
|
GHSA-gv7w-jh8g-vr73
Aliases: CVE-2025-62259 |
Liferay Portal Does Not Limit Access to APIs Before Email Verification Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, … | There are no reported fixed by versions. |
|
GHSA-xcj6-xpjg-c4xr
Aliases: CVE-2025-62261 |
Liferay Portal Stores Password Reset Tokens in Plain Text Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay … |
Vulnerable |
|
GHSA-pfxj-gvqg-mj44
Aliases: CVE-2025-43824 |
Liferay Profile Widget does not prevent vCard extension spoofing The Profile Widget in Liferay Portal 7.4.0 through 7.4.3.111, and older … |
Vulnerable |
|
GHSA-gh4w-8qgq-8w9r
Aliases: CVE-2025-62258 |
Liferay Portal Vulnerable to CSRF in Headless APIs CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and … | There are no reported fixed by versions. |
|
GHSA-56jv-4ww3-65mw
Aliases: CVE-2025-62265 |
Liferay Portal is vulnerable to XSS in the Blogs widget Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay … |
Vulnerable |
|
GHSA-8hw3-ghwv-crfh
Aliases: CVE-2025-62257 |
Liferay Portal vulnerable to password enumeration Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and … |
Vulnerable |
|
GHSA-62pf-hcwj-rcfc
Aliases: CVE-2025-43757 |
Liferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition Parameter A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 … | There are no reported fixed by versions. |
|
GHSA-g4vp-4gqr-7v8c
Aliases: CVE-2025-43743 |
Liferay Portal Enumeration Discrepancy in Calendars Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, … | There are no reported fixed by versions. |
|
GHSA-5fx5-cff6-f3fp
Aliases: CVE-2025-43749 |
Liferay Portal Unauthenticated File Access via URL Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through … | There are no reported fixed by versions. |
|
GHSA-mpww-r37c-vxjw
Aliases: CVE-2025-43746 |
Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal … | There are no reported fixed by versions. |
|
GHSA-m49p-6cjp-x2h3
Aliases: CVE-2025-43744 |
Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay … | There are no reported fixed by versions. |
|
GHSA-x7p4-v8mj-6fxx
Aliases: CVE-2025-43754 |
Liferay Portal Username Enumeration Vulnerability Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, … | There are no reported fixed by versions. |
|
GHSA-fvqv-593q-qp8r
Aliases: CVE-2025-43760 |
Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through … | There are no reported fixed by versions. |
|
GHSA-qpp6-f3qj-rggq
Aliases: CVE-2025-43752 |
Liferay Portal's Unlimited File Upload Could Result in DoS Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, … | There are no reported fixed by versions. |
|
GHSA-3p2m-574v-v257
Aliases: CVE-2025-43731 |
Liferay Portal Vulnerable to Cross-Site Scripting A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and … | There are no reported fixed by versions. |
|
GHSA-j6p8-g3rj-ghpm
Aliases: CVE-2025-43741 |
Liferay Portal Vulnerable to Cross-Site Scripting via assetTagNames Parameter A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 … | There are no reported fixed by versions. |
|
GHSA-7q33-gwcm-r6cj
Aliases: CVE-2025-43745 |
Liferay Portal CSRF Vulnerability via Endpoint Parameter A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 … | There are no reported fixed by versions. |
|
CVE-2025-43813
Aliases: GHSA-2hm7-r8f3-423h |
Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet Possible path traversal vulnerability and denial-of-service in the ComboServlet … | There are no reported fixed by versions. |
|
GHSA-2hm7-r8f3-423h
Aliases: CVE-2025-43813 |
Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet Possible path traversal vulnerability and denial-of-service in the ComboServlet … | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-hw56-7xj4-7gx6
|
Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module A SQL injection vulnerability in the Friendly … |
CVE-2022-42122
|