https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T04:54:35.852157+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0725 certfr-2025-avi-0725 — Une vulnérabilité a été découverte dans Liferay. Elle permet à un attaquant de provoquer une injection de code indirect… 2026-10-04T04:54:35.910770+00:00 certfr-2025-avi-0725 https://cve.radiocsirt.org/vuln/euvd-2026-250475 EUVD-2026-250475 2026-10-04T04:54:35.910811+00:00 EUVD-2026-250475 https://cve.radiocsirt.org/vuln/fkie_cve-2025-43760 fkie_cve-2025-43760 2026-10-04T04:54:35.910827+00:00

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect

 https://cve.radiocsirt.org/vuln/ghsa-fvqv-593q-qp8r GHSA-fvqv-593q-qp8r — Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect 2026-10-04T04:54:35.910858+00:00

Affected: Maven: com.liferay.portal:release.portal.bom

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1900 WID-SEC-W-2025-1900 — Liferay Portal: Mehrere Schwachstellen 2026-10-04T04:54:35.910882+00:00

Ein Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um Informationen offenzulegen, beliebigen Code auszuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand zu verursachen, Benutzer auf bösartige Websites umzuleiten und Cross-Site-Scripting-Angriffe durchzuführen.