https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T05:36:35.086374+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0954 certfr-2025-avi-0954 — De multiples vulnérabilités ont été découvertes dans Liferay. Elles permettent à un attaquant de provoquer une atteinte… 2026-10-06T05:36:35.089681+00:00 certfr-2025-avi-0954 https://cve.radiocsirt.org/vuln/euvd-2026-253242 EUVD-2026-253242 2026-10-06T05:36:35.089719+00:00 EUVD-2026-253242 https://cve.radiocsirt.org/vuln/fkie_cve-2025-43807 fkie_cve-2025-43807 2026-10-06T05:36:35.089733+00:00

Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a publication’s “Name” text field.

 https://cve.radiocsirt.org/vuln/ghsa-jh9h-8xf2-25wj GHSA-jh9h-8xf2-25wj — Liferay has a stored cross-site scripting (XSS) vulnerability via a a publication’s “Name” text field 2026-10-06T05:36:35.089762+00:00

Affected: Maven: com.liferay:com.liferay.change.tracking.service

Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a publication’s “Name” text field.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2106 WID-SEC-W-2025-2106 — Liferay Portal und DXP: Mehrere Schwachstellen 2026-10-06T05:36:35.089787+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen und Daten zu manipulieren.