Medium
CVE-2025-43778
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 437
Reset filters
Medium
CVE-2025-43777
Liferay Portal exposes 500 status when attempting login with a deleted client secret
Low
CVE-2025-43774
Liferay Portal is vulnerable to XSS attack through its Style Book theme
Medium
CVE-2025-43763
Liferay Portal is vulnerable to SSRF through custom object attachment fields
High
CVE-2025-43772
Liferay Portal Vulnerable to Denial of Service in Kaleo Forms Admin
Medium
CVE-2025-43773
Liferay Portal allows improper access through the expandoTableLocalService
Medium
CVE-2025-43766
Liferay Portal allows unrestricted upload of file in the style books component
Medium
CVE-2025-43765
Liferay Portal stored cross-site scripting in text field of the web content structure
Medium
CVE-2025-43767
Liferay Portal allows open redirect in /c/portal/edit_info_item parameter redirect
Medium
CVE-2025-43764
Liferay Portal ReDoS with Role Name search in KaleoDesignerPortlet
Medium
CVE-2025-43769
Liferay Portal vulnerable to Stored XSS in Components portlet
Medium
CVE-2025-43768
Liferay Portal JSONWS API endpoint shares sensitive information
Medium
CVE-2025-43770
Liferay Portal vulnerable to Reflected XSS with the referer and forward parameter
Medium
CVE-2025-43759
Liferay Portal users are able to add system admin portlets to pages
Medium
CVE-2025-43762
Liferay Portal users can upload an unlimited amount of files
Medium
CVE-2025-43758
Liferay Portal's unauthenticated users can access loaded files via URL before submitting the object entry
Medium
CVE-2025-43761
Liferay Portal Reflected XSS in CKeditor 4.21.0 endpoint
Medium
CVE-2025-43760
Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect
Medium
CVE-2025-43751
Liferay Portal User Enumeration Vulnerability via the Create Account Page
Medium
CVE-2025-43752
Liferay Portal's Unlimited File Upload Could Result in DoS
Low
CVE-2025-43753
Liferay Portal Reflected Cross-Site Scripting Vulnerability via Form Container
Medium
CVE-2025-43754
Liferay Portal Username Enumeration Vulnerability
Medium
CVE-2025-43756
Liferay Portal Reflected Cross-Site Scripting Vulnerability via snippet Parameter
Medium
CVE-2025-43755
Liferay Portal Stored Cross-Site Scripting Vulnerability via GroupPagesPortlet_type Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.