Threat database

143 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	4.8	EPSS 0.3%	CVE-2025-3760Liferay Portal · XSS or 'Cross-site Scripting' Medium4.8EPSS 0.3%2025-04-17CVE Database V5CVE-2025-3760 A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2025-04-17
Critical	9.0	EPSS 0.6%	CVE-2024-38002Liferay Portal · Missing Authorization Critical9.0EPSS 0.6%2024-10-22CVE Database V5CVE-2024-38002 The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API. EPSS 0.6%Vulnerability CWE-862	CVE Database V5	2024-10-22
Critical	9.8	KEVEPSS 99%	CVE-2020-7961 · Liferay Portal Deserialization of Untrusted Data Vulnerability Critical9.8KEVEPSS 99%2021-11-03CISA KEV CVE-2020-7961 is a deserialization of untrusted data vulnerability in Liferay Portal that allows remote attackers to execute arbitrary code via JSON web services. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data. KEVEPSS 99%Vulnerability CWE-502 #exploited-in-the-wild	CISA KEV	2021-11-03

Page 8 of 8