Medium
CVE-2025-43823
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 437
Reset filters
Medium
CVE-2025-43824
Liferay Profile Widget does not prevent vCard extension spoofing
Medium
CVE-2025-43825
Liferay Portal exposes sensitive user data through its Freemarker template
Medium
CVE-2025-43826
Liferay Portal Vulnerable to XSS in Web Content translation
Medium
CVE-2025-43827
Liferay Portal Vulnerable to IDOR via audit events
Medium
CVE-2025-43817
Liferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter
Medium
CVE-2025-43813
Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet
Medium
CVE-2025-43812
Liferay Portal vulnerable to cross-site scripting in the web content template
Medium
CVE-2025-43820
Liferay Portal vulnerable to cross-site scripting in the Calendar widget
Medium
CVE-2025-43818
Liferay Portal vulnerable to cross-site scripting in the Calendar widget
Medium
CVE-2025-43815
Liferay Portal vulnerable to reflected cross-site scripting on the page configuration page
Medium
CVE-2025-43811
Liferay Portal vulnerable to cross-site scripting in the related asset selector
Medium
CVE-2025-43816
Liferay Portal and DXP vulnerable to a memory leak
Medium
CVE-2025-43819
Liferay Portal and DXP does not properly expire sessions
Medium
CVE-2025-43814
Liferay Portal and DXP audit events record password reminder answers
Medium
CVE-2025-43806
Liferay Portal and DXP does not properly check permission with import and export tasks
Medium
CVE-2025-43810
Liferay Portal and DXP allows users to add a note to a different virtual instance
Medium
CVE-2025-43807
Liferay has a stored cross-site scripting (XSS) vulnerability via a a publication’s “Name” text field
Medium
CVE-2025-43808
Liferay Portal Commerce component has Incorrect Permission Assignment for Critical Resource
Medium
CVE-2025-43809
Liferay Portal Cross-Site Request Forgery (CSRF) vulnerability
Medium
CVE-2025-43803
Liferay Contacts Center widget has insecure direct object reference
Medium
CVE-2025-43804
Liferay search widget vulnerable to Cross-site Scripting
Medium
CVE-2025-43805
Liferay Portal allows remote attackers to view display page templates via crafted URLs
Medium
CVE-2025-59432
Timing Attack Vulnerability in SCRAM Authentication
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.