CVE Program partner

Liferay

Liferay, Inc.

API
CVEs, 365 days21211 all time, 1 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationLiferay, Inc.
RoleCNA
TypeVendor
Reports tomitre
ScopeAll Liferay supported products and end-of-life/end-of-service products.
Advisorieshttps://liferay.dev/portal/security/known-vulnerabilities

Latest CVEs · RSS

  • CVE-2025-62275 2025-11-01 · CVSS 6.9
    Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4
  • CVE-2025-62276 2025-10-31 · CVSS 4.6
    The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through
  • CVE-2025-62267 2025-10-31 · CVSS 4.6
    Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DX
  • CVE-2025-62264 2025-10-31 · CVSS 5.1
    Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.
  • CVE-2025-62265 2025-10-30 · CVSS 4.8
    Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.
  • CVE-2025-62266 2025-10-30 · CVSS 5.1
    By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2
  • CVE-2025-62257 2025-10-29 · CVSS 6.3
    Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.
  • CVE-2025-62258 2025-10-27 · CVSS 7.0
    CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA thro
  • CVE-2025-62259 2025-10-27 · CVSS 6.9
    Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through up
  • CVE-2025-62260 2025-10-27 · CVSS 7.1
    Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported ve
  • CVE-2025-62261 2025-10-27 · CVSS 6.9
    Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through upd
  • CVE-2025-62262 2025-10-27 · CVSS 4.6
    Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay
  • CVE-2025-62263 2025-10-27 · CVSS 4.8
    Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through updat
  • CVE-2025-62253 2025-10-27 · CVSS 6.9
    Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.
  • CVE-2025-62254 2025-10-23 · CVSS 6.9
    The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.
  • CVE-2025-62255 2025-10-23 · CVSS 2.0
    Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions,
  • CVE-2025-62256 2025-10-23 · CVSS 6.9
    Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through updat
  • CVE-2025-62247 2025-10-22 · CVSS 2.0
    Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 thr
  • CVE-2025-62248 2025-10-22 · CVSS 4.8
    A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay D
  • CVE-2025-62249 2025-10-21 · CVSS 6.9
    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 throu
  • CVE-2025-62250 2025-10-21 · CVSS 6.9
    Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 G
  • CVE-2025-62251 2025-10-13 · CVSS 4.8
    Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though upd
  • CVE-2025-62252 2025-10-13 · CVSS 5.3
    Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 throu
  • CVE-2025-62246 2025-10-13 · CVSS 4.8
    Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0
  • CVE-2025-62241 2025-10-13 · CVSS 5.3
    Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to fr

All CVE Program partners