https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T15:37:36.903576+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0713 certfr-2025-avi-0713 — De multiples vulnérabilités ont été découvertes dans les produits Liferay. Certaines d'entre elles permettent à un atta… 2026-10-05T15:37:36.906948+00:00 certfr-2025-avi-0713 https://cve.radiocsirt.org/vuln/euvd-2026-250223 EUVD-2026-250223 2026-10-05T15:37:36.906984+00:00 EUVD-2026-250223 https://cve.radiocsirt.org/vuln/fkie_cve-2025-43744 fkie_cve-2025-43744 2026-10-05T15:37:36.906999+00:00

A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 exists in the Asset Publisher configuration UI within the Source.js module. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels which are then inserted into the DOM using innerHTML without proper encoding.

 https://cve.radiocsirt.org/vuln/ghsa-m49p-6cjp-x2h3 GHSA-m49p-6cjp-x2h3 — Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels 2026-10-05T15:37:36.907028+00:00

Affected: Maven: com.liferay.portal:release.portal.bom

A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 exists in the Asset Publisher configuration UI within the Source.js module. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels which are then inserted into the DOM using innerHTML without proper encoding.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1865 WID-SEC-W-2025-1865 — Liferay Portal und DXP: Mehrere Schwachstellen 2026-10-05T15:37:36.907054+00:00

Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um Cross-Site-Scripting- und Phishing-Angriffe zu starten und vertrauliche Informationen offenzulegen.