https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T12:49:28.445074+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0954 certfr-2025-avi-0954 — De multiples vulnérabilités ont été découvertes dans Liferay. Elles permettent à un attaquant de provoquer une atteinte… 2026-10-05T12:49:28.448884+00:00 certfr-2025-avi-0954 https://cve.radiocsirt.org/vuln/euvd-2026-4226 EUVD-2026-4226 2026-10-05T12:49:28.448924+00:00 EUVD-2026-4226 https://cve.radiocsirt.org/vuln/fkie_cve-2024-25601 fkie_cve-2024-25601 2026-10-05T12:49:28.448939+00:00

Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the name text field of a geolocation custom field.

 https://cve.radiocsirt.org/vuln/ghsa-cr36-3vqf-x5w5 GHSA-cr36-3vqf-x5w5 — Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting 2026-10-05T12:49:28.448969+00:00

Affected: Maven: com.liferay.portal:release.portal.bom, Maven: com.liferay.portal:release.dxp.bom

Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the name text field of a geolocation custom field.

 https://cve.radiocsirt.org/vuln/gsd-2024-25601 gsd-2024-25601 2026-10-05T12:49:28.448997+00:00 gsd-2024-25601 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0440 WID-SEC-W-2024-0440 — Liferay Portal und Liferay DXP: Mehrere Schwachstellen 2026-10-05T12:49:28.449009+00:00

Ein entfernter Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um einen Cross-Site Scripting Angriff zu starten, vertrauliche Informationen offenzulegen oder Dateien zu manipulieren.