Liferay vulnerabilities and threats

143 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	6.7	EPSS 0.3%	CVE-2025-43759Liferay Portal · Incorrect Permissions Medium6.7EPSS 0.3%2025-08-22CVE Database V5CVE-2025-43759 Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows admin users of a virtual instance to add pages that are not in the default/main virtual instance, then any tenant can create a list of all other tenants. EPSS 0.3%Vulnerability CWE-732	CVE Database V5	2025-08-22
Medium	5.3	EPSS 0.4%	CVE-2025-43762Liferay Portal · Unthrottled Resource Allocation Medium5.3EPSS 0.4%2025-08-22CVE Database V5CVE-2025-43762 Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the forms, the files are stored in the document_library allowing an attacker to cause a potential DDoS. EPSS 0.4%Vulnerability CWE-770	CVE Database V5	2025-08-22
Medium	5.3	EPSS 0.3%	CVE-2025-43758Liferay Portal · Exposed Files or Directories Medium5.3EPSS 0.3%2025-08-22CVE Database V5CVE-2025-43758 Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded by object entry and stored in document_library EPSS 0.3%Vulnerability CWE-552	CVE Database V5	2025-08-22
Medium	5.3	EPSS 0.3%	CVE-2025-43760Liferay Portal · Cross-site Scripting Medium5.3EPSS 0.3%2025-08-22CVE Database V5CVE-2025-43760 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2025-08-22
Medium	6.9	EPSS 0.3%	CVE-2025-43751Liferay Portal · Observable Discrepancy Medium6.9EPSS 0.3%2025-08-22CVE Database V5CVE-2025-43751 User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10 and 7.4 GA through update 92 allows remote attackers to determine if an account exist in the application via the create account page. EPSS 0.3%Vulnerability CWE-203	CVE Database V5	2025-08-22
Medium	5.3	EPSS 0.3%	CVE-2025-43752Liferay Portal · Unthrottled Resource Allocation Medium5.3EPSS 0.3%2025-08-22CVE Database V5CVE-2025-43752 Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the object entries attachment fields, the files are stored in the document_library allowing an attacker to cause a potential DDoS. EPSS 0.3%Vulnerability CWE-770	CVE Database V5	2025-08-22
Low	2.1	EPSS 0.2%	CVE-2025-43753Liferay Portal · XSS or 'Cross-site Scripting' Low2.1EPSS 0.2%2025-08-21CVE Database V5CVE-2025-43753 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 update 32 through update 92 allows an remote authenticated user to inject JavaScript into the embedded message field from the form container. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-21
Medium	4.8	EPSS 0.2%	CVE-2025-43747Liferay DXP · Server-Side Request Forgery (SSRF) Medium4.8EPSS 0.2%2025-08-21CVE Database V5CVE-2025-43747 A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.domain.allowed, allowing an attacker to perform requests by change the domain and bypassing the validation method, this insecure validation is not distinguishing between trusted subdomains and malicious domains. EPSS 0.2%Vulnerability CWE-918	CVE Database V5	2025-08-21
Medium	6.9	EPSS 0.3%	CVE-2025-43754Liferay Portal · Timing Side Channel Medium6.9EPSS 0.3%2025-08-21CVE Database V5CVE-2025-43754 Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers to determine if an account exist in the application by inspecting the server processing time of the login request. EPSS 0.3%Vulnerability CWE-208	CVE Database V5	2025-08-21
Medium	5.1	EPSS 0.2%	CVE-2025-43755Liferay Portal · Cross-site Scripting Medium5.1EPSS 0.2%2025-08-21CVE Database V5CVE-2025-43755 A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.13, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_type parameter. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-21
Medium	6.9	EPSS 0.2%	CVE-2025-43756Liferay Portal · Cross-site Scripting Medium6.9EPSS 0.2%2025-08-21CVE Database V5CVE-2025-43756 <!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}-->A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.15, 2025.Q2.0 through 2025.Q2.2 and 2024.Q1.13 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via snippet parameter. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-21
Medium	4.8	EPSS 0.2%	CVE-2025-43757Liferay Portal · Cross-site Scripting Medium4.8EPSS 0.2%2025-08-20CVE Database V5CVE-2025-43757 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-20
Medium	5.1	EPSS 0.2%	CVE-2025-43746Liferay Portal · Cross-site Scripting Medium5.1EPSS 0.2%2025-08-20CVE Database V5CVE-2025-43746 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_portletNamespace and _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_namespace parameter. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-20
High	7.1	EPSS 0.2%	CVE-2025-43748Liferay Portal · Cross-Site Request Forgery (CSRF) High7.1EPSS 0.2%2025-08-20CVE Database V5CVE-2025-43748 Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery EPSS 0.2%Vulnerability CWE-352	CVE Database V5	2025-08-20
Medium	5.3	EPSS 0.3%	CVE-2025-43749Liferay Portal · Exposed Files or Directories Medium5.3EPSS 0.3%2025-08-20CVE Database V5CVE-2025-43749 Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded in the form and stored in document_library EPSS 0.3%Vulnerability CWE-552	CVE Database V5	2025-08-20
Medium	5.1	EPSS 0.3%	CVE-2025-43750Liferay Portal · Unrestricted File Upload Medium5.1EPSS 0.3%2025-08-20CVE Database V5CVE-2025-43750 Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows remote unauthenticated users (guests) to upload files via the form attachment field without proper validation, enabling extension obfuscation and bypassing MIME type checks. EPSS 0.3%Vulnerability CWE-434	CVE Database V5	2025-08-20
Medium	5.1	EPSS 0.2%	CVE-2025-43741Liferay Portal · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-08-20CVE Database V5CVE-2025-43741 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScrip in the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_assetTagNames parameter EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-20
Medium	6.9	EPSS 0.2%	CVE-2025-43742Liferay Portal · XSS or 'Cross-site Scripting' Medium6.9EPSS 0.2%2025-08-20CVE Database V5CVE-2025-43742 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript in web content for friendly urls. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-20
Medium	5.1	EPSS 0.2%	CVE-2025-43744Liferay Portal · Cross-site Scripting Medium5.1EPSS 0.2%2025-08-19CVE Database V5CVE-2025-43744 A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 exists in the Asset Publisher configuration UI within the Source.js module. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels which are then inserted into the DOM using innerHTML without proper encoding. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-19
Medium	5.3	EPSS 0.3%	CVE-2025-43743Liferay Portal · Observable Discrepancy Medium5.3EPSS 0.3%2025-08-19CVE Database V5CVE-2025-43743 Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated remote user to view other calendars by allowing them to enumerate the names of other users, given an attacker the possibility to send phishing to these users. EPSS 0.3%Vulnerability CWE-203	CVE Database V5	2025-08-19

Page 6 of 8