In Liferay Portal and DXP versions 7.4.0 through 7.4.3.132 and 2025.Q2.0 through 2025.Q2.7 a medium severity vulnerability CVE-2025-43745 was detected. This vulnerability allows attackers to perform a cross-origin request on behalf of the authenticated user via the endpoint parameter. To address this issue, users should upgrade Liferay Portal to master branch and Liferay DXP to versions 2025.Q2.8 or 2025.Q1.16. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43745.
Read more CMS
In Liferay Portal and DXP versions 7.4.0 through 7.4.3.132 a high severity vulnerability CVE-2025-43744 was detected. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels. To address this issue, users should upgrade Liferay Portal to master branch and Liferay DXP to versions 2025.Q2.6 or 2025.Q1.16. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43744.
Read more CMS
In Liferay Portal versions 7.4.0 through 7.4.3.132 and in Liferay DXP versions 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 a medium severity vulnerability CVE-2025-43743 was detected. This vulnerability allows attackers to view other calendars by enumerating the names of other authenticated users. To address this issue, users should upgrade Liferay Portal to master branch and Liferay DXP to versions 2025.Q2.0, 2025.Q1.6 or 2024.Q1.16. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43743.
Read more CMS
In Liferay Portal versions 7.4.0 through 7.4.3.132, and Liferay DXP versions 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 a medium severity vulnerability CVE-2025-43732 was detected. This vulnerability allows organization administrators to gain unauthorized access to user lists from other organizations due to an Insecure Direct Object Reference (IDOR) in the groupId parameter of the _com_liferay_roles_selector_web_portlet_RolesSelectorPortlet_groupId. To address this issue, users should upgrade Liferay Portal fixed on master branch and Liferay DXP to versions 2025.Q2.0, 2025.Q1.11 or 2024.Q1.18. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43732.
Read more CMS
In Liferay Portal versions 7.3.0 through 7.4.3.132 and Liferay DXP versions 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 a low severity vulnerability CVE-2025-3639 was detected. This vulnerability allows unauthenticated attackers with valid credentials to bypass multi-factor authentication (MFA) by changing the HTTP method from POST to GET during login. Currently, there is no fix version for this issue. For more details, visit CVE-2025-3639.
Read more CMS
In Liferay Portal versions 7.4.0 through 7.4.3.132, and Liferay DXP versions 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 a medium severity vulnerability CVE-2025-43731 was detected. This vulnerability allows remote authenticated attackers to inject JavaScript in message board threads and categories, leading to reflected cross-site scripting (XSS). To address this issue, users should upgrade Liferay Portal fixed on master branch and Liferay DXP 2025.Q2.0, 2025.Q1.9 or 2024.Q1.17. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43731.
Read more CMS
In Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier a high severity vulnerability CVE-2025-49558 was detected. This vulnerability allows attackers to bypass security features by exploiting a Time-of-check Time-of-use (TOCTOU) Race Condition, enabling unauthorized write access. To address this issue, users should upgrade Magento to versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14 or 2.4.4-p15. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-49558.
Read more E-commerce
In Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier a high severity vulnerability CVE-2025-49554 was detected. This vulnerability allows attackers to cause a denial-of-service (DoS) condition by providing specially crafted input, leading the application to crash or become unresponsive. To address this issue, users should upgrade Adobe Commerce to versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14 or 2.4.4-p15. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-49554.
Read more E-commerce
In Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier a high severity vulnerability CVE-2025-49555 was detected. This vulnerability allows attackers to escalate privileges through CSRF by tricking authenticated users into performing unintended actions, potentially enabling unauthorized access or modification of sensitive data. Currently, there is no fix version for this vulnerability. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-49555.
Read more E-commerce