WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product: Liferay✕
Overview 15 matches · 7 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 0 EPSS ≥ 0.5
15matches 7in Waratek scope46.7% 1protected6.7% 0exploited0.0% 0CISA KEV0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 6.7% Rule in development 0 0.0% Mitigation candidate 6 40.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 8 53.3% Withdrawn CVE 0 0.0%
Critical 1 6.7% High 1 6.7% Medium 13 86.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 6.7% partly blocked 0 0.0% not blocked 14 93.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 15 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Not applicable: 8Mitigation candidate: 6Protected by Waratek: 1 Medium: 13High: 1Critical: 1 not blocked: 14blocked by ARMR today: 1 Working exploit published: 15
20041 Not applicable1 Medium1 not blocked1 Working exploit published1 20051 Not applicable1 Medium1 not blocked1 Working exploit published1 20060 20072 Not applicable2 Medium2 not blocked2 Working exploit published2 20081 Not applicable1 Medium1 not blocked1 Working exploit published1 20091 Not applicable1 Medium1 not blocked1 Working exploit published1 20100 20111 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20120 20130 20140 20150 20161 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20170 20180 20192 Mitigation candidate1 Not applicable1 High1 Medium1 not blocked2 Working exploit published2 20201 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20210 20221 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20231 Not applicable1 Critical1 not blocked1 Working exploit published1 20240 20252 Mitigation candidate2 Medium2 not blocked2 Working exploit published2
20052007200920112013201520172019202120232025
15 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-4576 Medium 2025-08-08 Mitigation candidate Working exploit published A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/blogs/blogs-web/src/main/resources/META-INF/resources/blogs/entry_cover_image_caption.jsp
CVE-2025-4388 Medium 2025-05-06 Mitigation candidate Working exploit published A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.
CVE-2021-33990 Critical 2023-04-16 Not applicable Working exploit published Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the exploit reference link only shows frmfolders.html is accessible and does not demonstrate how an unauthorized user can upload a file.
CVE-2022-42118 Medium 2022-11-15 Mitigation candidate Working exploit published A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
CVE-2020-7934 Medium 2020-01-28 Mitigation candidate Working exploit published In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will then be rendered when a user utilizes the search feature to search for other users (i.e., if a user with modified fields occurs in the search results). This issue was fixed in Liferay Portal CE version 7.3.0 GA1.
CVE-2019-6588 Medium 2019-06-03 Mitigation candidate Working exploit published In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.
CVE-2019-11444 High 2019-04-22 Not applicable Working exploit published An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed via a [command].execute() call, as demonstrated by "def cmd =" in the ServerAdminPortlet_script value to group/control_panel/manage. Valid credentials for an application administrator user account are required. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groovy scripts and therefore not a design flaw
CVE-2016-3670 Medium 2016-06-13 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.
CVE-2011-1571 Medium 2011-05-07 Protected by Waratek Working exploit published Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
CVE-2009-1294 Medium 2009-04-16 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in web/guest/home in the Liferay 4.3.0 portal in Novell Teaming 1.0 through SP3 (1.0.3) allow remote attackers to inject arbitrary web script or HTML via the (1) p_p_state or (2) p_p_mode parameters.
CVE-2008-0178 Medium 2008-02-05 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in the Enterprise Admin Session Monitoring component in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the User-Agent HTTP header.
CVE-2007-6173 Medium 2007-11-30 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in c/portal/login in Liferay Enterprise Portal 4.3.1 allows remote attackers to inject arbitrary web script or HTML via the emailAddress parameter in a Send New Password action, a different vector than CVE-2007-6055. NOTE: some of these details are obtained from third party information.
CVE-2007-6055 Medium 2007-11-20 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in c/portal/login in Liferay Portal 4.1.0 and 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the login parameter. NOTE: this issue reportedly exists because of a regression that followed a fix at an unspecified earlier date.
CVE-2005-4400 Medium 2005-12-20 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in downloads/portal_ent in Liferay Portal Enterprise 3.6.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) _77_struts_action, (2) p_p_mode, and (3) p_p_state parameters.
CVE-2004-2030 Medium 2004-05-22 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in index.jsp for Liferay before 2.2.0 release 10/1/2004 allow remote attackers to inject arbitrary web script or HTML, as demonstrated using the message subject.