← Back

Liferay Portal

liferay_portal

Vendor: Liferay • 319 CVEs

CVEs (319)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-11444
1Liferay
1Liferay Portal
Jun 17, 2026
Apr 22, 2019
N/A· v4
7.2 HIGH· v3
9.0 HIGH· v2
An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed via a [command].execute() call, as demonstrated by "def cmd ="...Show more
An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed via a [command].execute() call, as demonstrated by "def cmd =" in the ServerAdminPortlet_script value to group/control_panel/manage. Valid credentials for an application administrator user account are required. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groovy scripts and therefore not a design flawShow less
CVE-2018-10795
1Liferay
1Liferay Portal
Nov 21, 2024
May 7, 2018
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment via a browser/liferay/br...Show more
Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment via a browser/liferay/browser.html?Type= or html/js/editor/fckeditor/editor/filemanager/browser/liferay/browser.html URI. NOTE: the vendor disputes this issue because file upload is an expected feature, subject to Role Based Access Control checks where only authenticated users with proper permissions can upload filesShow less
CVE-2017-1000425
1Liferay
1Liferay Portal
Nov 21, 2024
Jan 2, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the "movie" param...Show more
Cross-site scripting (XSS) vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the "movie" parameter.Show less
CVE-2017-17868
1Liferay
1Liferay Portal
May 13, 2026
Dec 27, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter (p_r_p) value, as demonstrated by p_r_p_564233524_tag.
CVE-2017-12649
1Liferay
1Liferay Portal
May 13, 2026
Aug 7, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display.
CVE-2017-12648
1Liferay
1Liferay Portal
May 13, 2026
Aug 7, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL.
CVE-2017-12647
1Liferay
1Liferay Portal
May 13, 2026
Aug 7, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title.
CVE-2017-12646
1Liferay
1Liferay Portal
May 13, 2026
Aug 7, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address.
CVE-2017-12645
1Liferay
1Liferay Portal
May 13, 2026
Aug 7, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.
CVE-2016-10404
1Liferay
1Liferay Portal
May 13, 2026
Aug 7, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted redirect field to modules/apps/foundation/frontend-js/frontend-js-spa-web/src/main/resources/META-INF/resources/init.jsp.
CVE-2010-5327
1Liferay
1Liferay Portal
May 13, 2026
Jan 13, 2017
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.
CVE-2016-3670
1Liferay
1Liferay Portal
May 6, 2026
Jun 13, 2016
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.
CVE-2014-8349
1Liferay
1Liferay Portal
May 6, 2026
Nov 24, 2014
N/A· v4
N/A· v3
3.5 LOW· v2
Cross-site scripting (XSS) vulnerability in Liferay Portal Enterprise Edition (EE) 6.2 SP8 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the _20_body parameter in the comment fi...Show more
Cross-site scripting (XSS) vulnerability in Liferay Portal Enterprise Edition (EE) 6.2 SP8 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the _20_body parameter in the comment field in an uploaded file.Show less
CVE-2014-2963
1Liferay
1Liferay Portal
May 6, 2026
Jul 10, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in group/control_panel/manage in Liferay Portal 6.1.2 CE GA3, 6.1.X EE, and 6.2.X EE allow remote attackers to inject arbitrary web script or HTML via the (1) _2_firstN...Show more
Multiple cross-site scripting (XSS) vulnerabilities in group/control_panel/manage in Liferay Portal 6.1.2 CE GA3, 6.1.X EE, and 6.2.X EE allow remote attackers to inject arbitrary web script or HTML via the (1) _2_firstName, (2) _2_lastName, or (3) _2_middleName parameter.Show less
CVE-2011-1571
1Liferay
1Liferay Portal
Apr 29, 2026
May 7, 2011
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vec...Show more
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.Show less
CVE-2011-1570
1Liferay
1Liferay Portal
Apr 29, 2026
May 7, 2011
N/A· v4
N/A· v3
3.5 LOW· v2
Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message ti...Show more
Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.Show less
CVE-2011-1503
1Liferay
1Liferay Portal
Apr 29, 2026
May 7, 2011
N/A· v4
N/A· v3
3.5 LOW· v2
The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files...Show more
The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL.Show less
CVE-2011-1502
1Liferay
1Liferay Portal
Apr 29, 2026
May 7, 2011
N/A· v4
N/A· v3
4.0 MEDIUM· v2
Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related...Show more
Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity (aka XXE) issue.Show less
CVE-2009-3742
1Liferay
1Liferay Portal
Apr 23, 2026
Jan 7, 2010
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Liferay Portal before 5.3.0 allows remote attackers to inject arbitrary web script or HTML via the p_p_id parameter.