https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T15:37:58.943661+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0713 certfr-2025-avi-0713 — De multiples vulnérabilités ont été découvertes dans les produits Liferay. Certaines d'entre elles permettent à un atta… 2026-10-05T15:37:58.946860+00:00 certfr-2025-avi-0713 https://cve.radiocsirt.org/vuln/euvd-2026-250158 EUVD-2026-250158 2026-10-05T15:37:58.946897+00:00 EUVD-2026-250158 https://cve.radiocsirt.org/vuln/fkie_cve-2025-43740 fkie_cve-2025-43740 2026-10-05T15:37:58.946912+00:00

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.9 through 2024.Q1.19 allows an remote authenticated attacker to inject JavaScript through the message boards feature available via the web interface.

 https://cve.radiocsirt.org/vuln/ghsa-22jp-w3cg-gvmm GHSA-22jp-w3cg-gvmm — Liferay Portal has Stored Cross-Site Scripting Vulnerability via Message Boards Feature 2026-10-05T15:37:58.946941+00:00

Affected: Maven: com.liferay.portal:release.portal.bom

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.9 through 2024.Q1.19 allows an remote authenticated attacker to inject JavaScript through the message boards feature available via the web interface.

Liferay Portal is fixed on the master branch from commit c1b7c6b.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1865 WID-SEC-W-2025-1865 — Liferay Portal und DXP: Mehrere Schwachstellen 2026-10-05T15:37:58.946966+00:00

Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um Cross-Site-Scripting- und Phishing-Angriffe zu starten und vertrauliche Informationen offenzulegen.