https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T18:30:23.865178+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0954 certfr-2025-avi-0954 — De multiples vulnérabilités ont été découvertes dans Liferay. Elles permettent à un attaquant de provoquer une atteinte… 2026-10-03T18:30:23.953508+00:00 certfr-2025-avi-0954 https://cve.radiocsirt.org/vuln/euvd-2026-254614 EUVD-2026-254614 2026-10-03T18:30:23.953553+00:00 EUVD-2026-254614 https://cve.radiocsirt.org/vuln/fkie_cve-2025-62237 fkie_cve-2025-62237 2026-10-03T18:30:23.953568+00:00

Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 8 through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account’s “Name” text field.

 https://cve.radiocsirt.org/vuln/ghsa-m4g9-5mg6-gfr3 GHSA-m4g9-5mg6-gfr3 — Liferay Portal Commerce is vulnerable to XSS through account "name" field 2026-10-03T18:30:23.953603+00:00

Affected: Maven: com.liferay.commerce:com.liferay.commerce.order.web

Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 8 through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account’s “Name” text field.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2256 WID-SEC-W-2025-2256 — Liferay Portal und DXP: Mehrere Schwachstellen 2026-10-03T18:30:23.953631+00:00

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und Daten zu manipulieren.