Vulnerability index

Browse CVEs

278 matching
Filters 1 Clear all
Severity

Filters apply as you choose them.

Digital Experience Platform MEDIUM 5.4
CVE-2025-43822

Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5,…

Fix: 7.4.3.112 / 2023.q3.9+
Fix from $1,600 2025-10-07
Digital Experience Platform MEDIUM 5.4
CVE-2025-43823

Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 befo…

Fix: 7.4.3.112 / 2023.q3.9+
Fix from $1,600 2025-10-07
Digital Experience Platform MEDIUM 5.4
CVE-2025-43824

The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 …

Fix: 7.4.3.112 / 2023.q3.9+
Fix from $1,600 2025-10-06
Digital Experience Platform MEDIUM 6.5
CVE-2025-43825

A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 throug…

Fix: 2024.Q1.13 / 2024.Q4.6+
Fix from $1,600 2025-10-03
Digital Experience Platform MEDIUM 5.4
CVE-2025-43826

Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported version…

Fix: 7.4.3.113 / 2023.Q4.9+
Fix from $1,600 2025-09-30
Digital Experience Platform HIGH 8.2
CVE-2025-43813

Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported vers…

Fix: 7.3 / 7.4.3.108+
Fix from $1,950 2025-09-29
Digital Experience Platform MEDIUM 6.1
CVE-2025-43817

Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4…

Fix: 7.4.3.112 / 2023.q3.9+
Fix from $1,600 2025-09-29
Digital Experience Platform MEDIUM 5.4
CVE-2025-43812

Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.…

Fix: 7.4.3.112 / 2023.q3.9+
Fix from $1,600 2025-09-29
Digital Experience Platform MEDIUM 5.4
CVE-2025-43820

Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.11…

Fix: 7.4.3.111 / 2023.Q3.7+
Fix from $1,600 2025-09-29
Digital Experience Platform MEDIUM 6.1
CVE-2025-43815

Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023…

Fix: 7.4.3.111 / 2023.q4.3+
Fix from $1,600 2025-09-29
Digital Experience Platform MEDIUM 6.1
CVE-2025-43818

Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.…

Fix: 7.4.3.111 / 2023.Q3.7+
Fix from $1,600 2025-09-29
Digital Experience Platform MEDIUM 5.4
CVE-2025-43811

Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP …

Fix: 7.4.3.112 / 2023.Q3.8+
Fix from $1,600 2025-09-29
Digital Experience Platform HIGH 7.5
CVE-2025-43816

A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2…

Fix: 7.4 / 7.4.3.120+
Fix from $1,950 2025-09-25
Digital Experience Platform MEDIUM 6.5
CVE-2025-43819

A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.…

Fix: 7.4.3.132 / 2024.Q1.13+
Fix from $1,600 2025-09-24
Digital Experience Platform MEDIUM 6.1
CVE-2025-43779

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and …

Fix: 7.4.3.113 / 2024.Q1.19+
Fix from $1,600 2025-09-24
Digital Experience Platform MEDIUM 6.5
CVE-2025-43814

In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10,…

Fix: 7.4.3.113 / 2023.Q4.9+
Fix from $1,600 2025-09-22
Digital Experience Platform MEDIUM 5.4
CVE-2025-43807

Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 thro…

Fix: 7.4.3.113 / 2023.Q4.9+
Fix from $1,600 2025-09-22
Digital Experience Platform MEDIUM 5.3
CVE-2025-43808

The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA t…

Fix: 7.4.3.113 / 2023.Q4.9+
Fix from $1,600 2025-09-19
Digital Experience Platform MEDIUM 6.1
CVE-2025-43804

Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through …

Fix: 7.4.3.112+
Fix from $1,600 2025-09-16
Digital Experience Platform MEDIUM 5.3
CVE-2025-43805

Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 3…

Fix: 7.4.3.112 / 2023.Q3.5+
Fix from $1,600 2025-09-16
Digital Experience Platform HIGH 7.5
CVE-2025-43801

Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DX…

Fix: 7.3 / 7.4.3.112+
Fix from $1,950 2025-09-16
Digital Experience Platform MEDIUM 6.1
CVE-2025-43802

Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, an…

Fix: 7.4.3.110 / 2023.q3.5+
Fix from $1,600 2025-09-15
Digital Experience Platform MEDIUM 5.4
CVE-2025-43797

In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35…

Fix: 7.3 / 7.4.3.112+
Fix from $1,600 2025-09-15
Digital Experience Platform MEDIUM 6.5
CVE-2025-43798

Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP…

Fix: 2023.q3.5+
Fix from $1,600 2025-09-15
Digital Experience Platform MEDIUM 6.5
CVE-2025-43799

Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update…

Fix: 7.3 / 7.4.3.112+
Fix from $1,600 2025-09-15
Digital Experience Platform MEDIUM 6.1
CVE-2025-43800

Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q…

Fix: 7.4.3.112 / 2023.q3.5+
Fix from $1,600 2025-09-15
Digital Experience Platform MEDIUM 6.1
CVE-2025-43791

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4…

Fix: 7.4.3.112 / 2023.q3.5+
Fix from $1,600 2025-09-15
Digital Experience Platform MEDIUM 5.3
CVE-2025-43792

Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4…

Fix: 7.3 / 7.4.3.106+
Fix from $1,600 2025-09-15
Digital Experience Platform HIGH 7.5
CVE-2025-43793

Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update…

Fix: 7.3 / 7.4.3.106+
Fix from $1,950 2025-09-15
Digital Experience Platform HIGH 7.5
CVE-2025-43796

Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not li…

Fix: 7.4.3.102 / 2023.Q3.5+
Fix from $1,950 2025-09-12