Vulnerabilities > Liferay > DXP > 7.1

DATE CVE VULNERABILITY TITLE RISK
2024-02-07 CVE-2024-25145 Cross-site Scripting vulnerability in Liferay DXP
Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application.
network
low complexity
liferay CWE-79
5.4
2022-11-15 CVE-2022-42118 Cross-site Scripting vulnerability in Liferay Portal
A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
network
low complexity
liferay CWE-79
6.1
2022-11-15 CVE-2022-42121 SQL Injection vulnerability in Liferay DXP and Liferay Portal
A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.
network
low complexity
liferay CWE-89
8.8
2022-11-15 CVE-2022-42110 Cross-site Scripting vulnerability in Liferay Portal
A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML.
network
low complexity
liferay CWE-79
6.1
2022-10-19 CVE-2022-38901 Cross-site Scripting vulnerability in Liferay DXP and Liferay Portal
A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.
network
low complexity
liferay CWE-79
5.4
2022-10-18 CVE-2022-42112 Cross-site Scripting vulnerability in Liferay DXP
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
network
low complexity
liferay CWE-79
5.4
2022-10-18 CVE-2022-42114 Cross-site Scripting vulnerability in Liferay DXP 7.0/7.4
A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and Liferay DXP 7.4 before update 37 allows remote attackers to inject arbitrary web script or HTML.
network
low complexity
liferay CWE-79
5.4
2022-10-18 CVE-2022-42116 Cross-site Scripting vulnerability in Liferay DXP 7.0
A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the (1) name, or (2) namespace parameter.
network
low complexity
liferay CWE-79
6.1
2022-10-18 CVE-2022-42117 Cross-site Scripting vulnerability in Liferay DXP 7.0
A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML.
network
low complexity
liferay CWE-79
6.1
2021-08-04 CVE-2021-33337 Cross-site Scripting vulnerability in Liferay DXP and Liferay Portal
Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.
network
liferay CWE-79
4.3