Search for packages
| purl | pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.129 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 3.1 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-62pf-hcwj-rcfc
Aliases: CVE-2025-43757 |
Liferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition Parameter A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 … | There are no reported fixed by versions. |
|
GHSA-g4vp-4gqr-7v8c
Aliases: CVE-2025-43743 |
Liferay Portal Enumeration Discrepancy in Calendars Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, … | There are no reported fixed by versions. |
|
GHSA-5fx5-cff6-f3fp
Aliases: CVE-2025-43749 |
Liferay Portal Unauthenticated File Access via URL Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through … | There are no reported fixed by versions. |
|
GHSA-mpww-r37c-vxjw
Aliases: CVE-2025-43746 |
Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal … | There are no reported fixed by versions. |
|
GHSA-m49p-6cjp-x2h3
Aliases: CVE-2025-43744 |
Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay … | There are no reported fixed by versions. |
|
GHSA-x7p4-v8mj-6fxx
Aliases: CVE-2025-43754 |
Liferay Portal Username Enumeration Vulnerability Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, … | There are no reported fixed by versions. |
|
GHSA-g4wg-mpfg-x2q6
Aliases: CVE-2025-3639 |
Liferay Portal Login Bypass Vulnerability Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 … | There are no reported fixed by versions. |
|
GHSA-fvqv-593q-qp8r
Aliases: CVE-2025-43760 |
Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through … | There are no reported fixed by versions. |
|
GHSA-22jp-w3cg-gvmm
Aliases: CVE-2025-43740 |
Liferay Portal has Stored Cross-Site Scripting Vulnerability via Message Boards Feature A Stored cross-site scripting vulnerability in the Liferay Portal … | There are no reported fixed by versions. |
|
GHSA-qpp6-f3qj-rggq
Aliases: CVE-2025-43752 |
Liferay Portal's Unlimited File Upload Could Result in DoS Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, … | There are no reported fixed by versions. |
|
GHSA-3p2m-574v-v257
Aliases: CVE-2025-43731 |
Liferay Portal Vulnerable to Cross-Site Scripting A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and … | There are no reported fixed by versions. |
|
GHSA-j6p8-g3rj-ghpm
Aliases: CVE-2025-43741 |
Liferay Portal Vulnerable to Cross-Site Scripting via assetTagNames Parameter A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 … | There are no reported fixed by versions. |
|
GHSA-7q33-gwcm-r6cj
Aliases: CVE-2025-43745 |
Liferay Portal CSRF Vulnerability via Endpoint Parameter A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 … | There are no reported fixed by versions. |
|
CVE-2025-43735
Aliases: GHSA-222w-xmc5-jhp3 |
Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability A reflected cross-site scripting (XSS) vulnerability in the Liferay … |
Vulnerable Vulnerable |
|
GHSA-qhp6-vp7c-g7xp
Aliases: CVE-2025-3760 |
Liferay Cross-site Scripting vulnerability A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal … |
Vulnerable Vulnerable |
|
GHSA-222w-xmc5-jhp3
Aliases: CVE-2025-43735 |
Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability A reflected cross-site scripting (XSS) vulnerability in the Liferay … |
Vulnerable Vulnerable |
|
GHSA-cg99-m88x-422c
Aliases: CVE-2025-43736 |
Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability A Denial Of Service via … | There are no reported fixed by versions. |
|
GHSA-c6g5-g6r7-q4j6
Aliases: CVE-2025-4655 |
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery An SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 … | There are no reported fixed by versions. |
|
GHSA-m5c7-5gv3-hcpf
Aliases: CVE-2025-43734 |
Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability A reflected cross-site scripting (XSS) vulnerability in … | There are no reported fixed by versions. |
|
GHSA-6v93-frf9-2rp8
Aliases: CVE-2025-4581 |
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through … | There are no reported fixed by versions. |
|
GHSA-rcc7-jx7p-hrv4
Aliases: CVE-2025-43776 |
Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting A stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 … | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-9fcg-wrp8-qhr4
|
Liferay Portal and Liferay DXP Reveals Data via Forms The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and … |
CVE-2025-2565
|
|
GHSA-hrc4-p2h3-pjqw
|
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, … |
CVE-2025-2536
|
|
GHSA-66x6-8jgv-qpfh
|
Liferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting A stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 … |
CVE-2025-43785
|