Browse CVEs

MEDIUM 5.4 CVE-2025-43822 Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5,… Digital Experience Platform 7.4.3.112 / 2023.q3.9+ Fix from $1,6002025-10-07 MEDIUM 5.4 CVE-2025-43823 Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 befo… Digital Experience Platform 7.4.3.112 / 2023.q3.9+ Fix from $1,6002025-10-07 MEDIUM 5.4 CVE-2025-43824 The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 … Digital Experience Platform 7.4.3.112 / 2023.q3.9+ Fix from $1,6002025-10-06 MEDIUM 6.5 CVE-2025-43825 A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 throug… Digital Experience Platform 2024.Q1.13 / 2024.Q4.6+ Fix from $1,6002025-10-03 MEDIUM 5.4 CVE-2025-43826 Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported version… Digital Experience Platform 7.4.3.113 / 2023.Q4.9+ Fix from $1,6002025-09-30 HIGH 8.2 CVE-2025-43813 Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported vers… Digital Experience Platform 7.3 / 7.4.3.108+ Fix from $1,9502025-09-29 MEDIUM 6.1 CVE-2025-43817 Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4… Digital Experience Platform 7.4.3.112 / 2023.q3.9+ Fix from $1,6002025-09-29 MEDIUM 5.4 CVE-2025-43812 Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.… Digital Experience Platform 7.4.3.112 / 2023.q3.9+ Fix from $1,6002025-09-29 MEDIUM 5.4 CVE-2025-43820 Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.11… Digital Experience Platform 7.4.3.111 / 2023.Q3.7+ Fix from $1,6002025-09-29 MEDIUM 6.1 CVE-2025-43815 Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023… Digital Experience Platform 7.4.3.111 / 2023.q4.3+ Fix from $1,6002025-09-29 MEDIUM 6.1 CVE-2025-43818 Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.… Digital Experience Platform 7.4.3.111 / 2023.Q3.7+ Fix from $1,6002025-09-29 MEDIUM 5.4 CVE-2025-43811 Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP … Digital Experience Platform 7.4.3.112 / 2023.Q3.8+ Fix from $1,6002025-09-29 HIGH 7.5 CVE-2025-43816 A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2… Digital Experience Platform 7.4 / 7.4.3.120+ Fix from $1,9502025-09-25 MEDIUM 6.5 CVE-2025-43819 A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.… Digital Experience Platform 7.4.3.132 / 2024.Q1.13+ Fix from $1,6002025-09-24 MEDIUM 6.1 CVE-2025-43779 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and … Digital Experience Platform 7.4.3.113 / 2024.Q1.19+ Fix from $1,6002025-09-24 MEDIUM 6.5 CVE-2025-43814 In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10,… Digital Experience Platform 7.4.3.113 / 2023.Q4.9+ Fix from $1,6002025-09-22 MEDIUM 5.4 CVE-2025-43807 Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 thro… Digital Experience Platform 7.4.3.113 / 2023.Q4.9+ Fix from $1,6002025-09-22 MEDIUM 5.3 CVE-2025-43808 The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA t… Digital Experience Platform 7.4.3.113 / 2023.Q4.9+ Fix from $1,6002025-09-19 MEDIUM 6.1 CVE-2025-43804 Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through … Digital Experience Platform 7.4.3.112+ Fix from $1,6002025-09-16 MEDIUM 5.3 CVE-2025-43805 Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 3… Digital Experience Platform 7.4.3.112 / 2023.Q3.5+ Fix from $1,6002025-09-16 HIGH 7.5 CVE-2025-43801 Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DX… Digital Experience Platform 7.3 / 7.4.3.112+ Fix from $1,9502025-09-16 MEDIUM 6.1 CVE-2025-43802 Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, an… Digital Experience Platform 7.4.3.110 / 2023.q3.5+ Fix from $1,6002025-09-15 MEDIUM 5.4 CVE-2025-43797 In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35… Digital Experience Platform 7.3 / 7.4.3.112+ Fix from $1,6002025-09-15 MEDIUM 6.5 CVE-2025-43798 Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP… Digital Experience Platform 2023.q3.5+ Fix from $1,6002025-09-15 MEDIUM 6.5 CVE-2025-43799 Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update… Digital Experience Platform 7.3 / 7.4.3.112+ Fix from $1,6002025-09-15 MEDIUM 6.1 CVE-2025-43800 Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q… Digital Experience Platform 7.4.3.112 / 2023.q3.5+ Fix from $1,6002025-09-15 MEDIUM 6.1 CVE-2025-43791 Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4… Digital Experience Platform 7.4.3.112 / 2023.q3.5+ Fix from $1,6002025-09-15 MEDIUM 5.3 CVE-2025-43792 Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4… Digital Experience Platform 7.3 / 7.4.3.106+ Fix from $1,6002025-09-15 HIGH 7.5 CVE-2025-43793 Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update… Digital Experience Platform 7.3 / 7.4.3.106+ Fix from $1,9502025-09-15 HIGH 7.5 CVE-2025-43796 Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not li… Digital Experience Platform 7.4.3.102 / 2023.Q3.5+ Fix from $1,9502025-09-12