Threat database

143 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	6.2	EPSS 0.3%	CVE-2025-43784Liferay Portal · Incorrect Authorization Medium6.2EPSS 0.3%2025-09-10CVE Database V5CVE-2025-43784 Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows guest users to obtain object entries information via the API Builder. EPSS 0.3%Vulnerability CWE-863	CVE Database V5	2025-09-10
Medium	4.6	EPSS 0.2%	CVE-2025-43785Liferay Portal · XSS or 'Cross-site Scripting' Medium4.6EPSS 0.2%2025-09-10CVE Database V5CVE-2025-43785 Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through update 92 allows remote attackers to execute an arbitrary web script or HTML in the My Workflow Tasks page. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-10
Medium	6.9	EPSS 0.3%	CVE-2025-43786Liferay Portal · XSS or 'Cross-site Scripting' Medium6.9EPSS 0.3%2025-09-09CVE Database V5CVE-2025-43786 Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 and 7.4 GA through update 92 allow attackers to determine existent ERC in the application by exploit the time response. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2025-09-09
Medium	5.3	EPSS 0.2%	CVE-2025-43781Liferay Portal · XSS or 'Cross-site Scripting' Medium5.3EPSS 0.2%2025-09-09CVE Database V5CVE-2025-43781 Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.12 allows remote attackers to inject arbitrary web script or HTML via the URL in search bar portlet EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-09
Medium	4.6	EPSS 0.2%	CVE-2025-43775Liferay Portal · XSS or 'Cross-site Scripting' Medium4.6EPSS 0.2%2025-09-09CVE Database V5CVE-2025-43775 Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via remote app title field. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-09
Medium	4.6	EPSS 0.2%	CVE-2025-43776Liferay Portal · Generation of Error Message Containing Sensitive Information Medium4.6EPSS 0.2%2025-09-09CVE Database V5CVE-2025-43776 A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping. EPSS 0.2%Vulnerability CWE-209	CVE Database V5	2025-09-09
Medium	5.1	EPSS 0.2%	CVE-2025-43777Liferay Portal · Generation of Error Message Containing Sensitive Information Medium5.1EPSS 0.2%2025-09-09CVE Database V5CVE-2025-43777 Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 exposes "Internal Server Error" in the response body when a login attempt is made with a deleted Client Secret. EPSS 0.2%Vulnerability CWE-209	CVE Database V5	2025-09-09
Medium	4.8	EPSS 0.2%	CVE-2025-43778Liferay Portal · XSS or 'Cross-site Scripting' Medium4.8EPSS 0.2%2025-09-09CVE Database V5CVE-2025-43778 A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 allows an remote authenticated attacker to inject JavaScript through the name of a fieldset in Kaleo Forms Admin. The malicious payload is stored and executed without proper sanitization or escaping. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-09
Medium	4.8	EPSS 0.2%	CVE-2025-43763Liferay Portal · Server-Side Request Forgery (SSRF) Medium4.8EPSS 0.2%2025-09-08CVE Database V5CVE-2025-43763 A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 that affects custom object attachment fields. This flaw allows an attacker to manipulate the application into making unauthorized requests to other instances, creating new object entries that link to external resources. EPSS 0.2%Vulnerability CWE-918	CVE Database V5	2025-09-08
High	7.1	EPSS 0.5%	CVE-2025-43772Liferay Portal · Uncontrolled Resource Consumption High7.1EPSS 0.5%2025-09-04CVE Database V5CVE-2025-43772 Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions does not restrict the saving of request parameters in the portlet session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP request. EPSS 0.5%Vulnerability CWE-400	CVE Database V5	2025-09-04
High	7.5	EPSS 0.4%	CVE-2025-3586Liferay Portal · Incorrect Authorization High7.5EPSS 0.4%2025-09-01CVE Database V5CVE-2025-3586 In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 (Liferay PaaS, and Liferay Self-Hosted), the Objects module does not restrict the use of Groovy scripts in Object actions for Admin Users. This allows remote authenticated admin users with the Instance Administrator role to execute arbitrary Groovy scripts (i.e., remote code execution) through Object actions. In contrast, in Liferay DXP (Liferay SaaS), the use of Groovy in Object actions is not allowed due to the high security risks it poses. Starting from Liferay DXP 2024.Q2 and later, a new feature has been introduced in Instance Settings that allows administrators to configure whether Groovy scripts are allowed in their instances. EPSS 0.4%Vulnerability CWE-863	CVE Database V5	2025-09-01
Medium	4.6	EPSS 0.3%	CVE-2025-43773Liferay Portal · Missing Authorization Medium4.6EPSS 0.3%2025-08-29CVE Database V5CVE-2025-43773 Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 has a security vulnerability that allowing for improper access through the expandoTableLocalService. EPSS 0.3%Vulnerability CWE-862	CVE Database V5	2025-08-29
Medium	6.9	EPSS 0.3%	CVE-2025-43764Liferay Portal · ReDoS Medium6.9EPSS 0.3%2025-08-23CVE Database V5CVE-2025-43764 Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.1, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92, which allows authenticated users with permissions to update Kaleo Workflows to enter a malicious Regex pattern causing their browser to hang for a very long time. EPSS 0.3%Vulnerability CWE-1333	CVE Database V5	2025-08-23
Medium	6.9	EPSS 0.2%	CVE-2025-43765Liferay Portal · XSS or 'Cross-site Scripting' Medium6.9EPSS 0.2%2025-08-23CVE Database V5CVE-2025-43765 A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the text field from a web content. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-23
Medium	6.8	EPSS 0.4%	CVE-2025-43766Liferay Portal · Unrestricted File Upload Medium6.8EPSS 0.4%2025-08-23CVE Database V5CVE-2025-43766 The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows the upload of unrestricted files in the style books component that are processed within the environment enabling arbitrary code execution by attackers. EPSS 0.4%Vulnerability CWE-434	CVE Database V5	2025-08-23
Medium	5.1	EPSS 0.2%	CVE-2025-43767Liferay Portal · Open Redirect Medium5.1EPSS 0.2%2025-08-23CVE Database V5CVE-2025-43767 Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 update 86 through update 92 allows an attacker to exploit this security vulnerability to redirect users to a malicious site. EPSS 0.2%Vulnerability CWE-601	CVE Database V5	2025-08-23
Medium	5.1	EPSS 0.3%	CVE-2025-43768Liferay Portal · Insertion of Sensitive Information Into Sent Data Medium5.1EPSS 0.3%2025-08-23CVE Database V5CVE-2025-43768 Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows authenticated users without any permissions to access sensitive information of admin users using JSONWS APIs. EPSS 0.3%Vulnerability CWE-201	CVE Database V5	2025-08-23
Medium	4.6	EPSS 0.2%	CVE-2025-43769Liferay Portal · XSS or 'Cross-site Scripting' Medium4.6EPSS 0.2%2025-08-23CVE Database V5CVE-2025-43769 Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute arbitrary web script or HTML via components tab. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-23
Medium	6.9	EPSS 0.2%	CVE-2025-43770Liferay Portal · XSS or 'Cross-site Scripting' Medium6.9EPSS 0.2%2025-08-23CVE Database V5CVE-2025-43770 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the referer or FORWARD_URL using %00 in those parameters. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-23
Medium	6.9	EPSS 0.2%	CVE-2025-43761Liferay Portal · XSS or 'Cross-site Scripting' Medium6.9EPSS 0.2%2025-08-22CVE Database V5CVE-2025-43761 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the frontend-editor-ckeditor-web/ckeditor/samples/old/ajax.html path EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-22

Page 5 of 8