Liferay Portal versions 7.4.0 through 7.4.3.99 and certain older versions store password reset tokens in plain text within the database. This vulnerability allows attackers with database access to retrieve these tokens, reset user passwords, and take over user accounts. Fixed versions 7.4.3.100 and 92.0.2 address this issue.