{"schema_version":1,"title":"Liferay Digital Experience Platform vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 18 vulnerabilities in Liferay Digital Experience Platform: 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2025-62275, was published on 1 November 2025.","url":"https://junglewise.ai/threats/technologies/digital-experience-platform","json_url":"https://junglewise.ai/threats/technologies/digital-experience-platform.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/digital-experience-platform","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":true,"counts":{"high":2,"all_time":18,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":0},"latest":[{"cve":"CVE-2025-62275","cvss":5.3,"epss":0.0029,"slug":"cve-2025-62275-liferay-portal-and-dxp-do-not-check-permissions-of-images-in-a","title":"Liferay Portal and DXP do not check permissions of images in a blog entry","severity":"medium","exploited":false,"published_at":"2025-11-01T03:15:31.757+00:00","url":"https://junglewise.ai/threats/cve-2025-62275-liferay-portal-and-dxp-do-not-check-permissions-of-images-in-a"},{"cve":"CVE-2025-62276","cvss":5.5,"epss":0.0013,"slug":"cve-2025-62276-liferay-portal-and-dxp-use-an-incorrect-cache-control-header","title":"Liferay Portal and DXP use an incorrect cache-control header","severity":"medium","exploited":false,"published_at":"2025-11-01T00:15:33.387+00:00","url":"https://junglewise.ai/threats/cve-2025-62276-liferay-portal-and-dxp-use-an-incorrect-cache-control-header"},{"cve":"CVE-2025-62267","cvss":6.1,"epss":0.0023,"slug":"cve-2025-62267-liferay-portal-and-dxp-affected-by-multiple-cross-site-scripting","title":"Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal…","severity":"medium","exploited":false,"published_at":"2025-10-31T19:15:50.61+00:00","url":"https://junglewise.ai/threats/cve-2025-62267-liferay-portal-and-dxp-affected-by-multiple-cross-site-scripting"},{"cve":"CVE-2025-62265","cvss":5.4,"epss":0.0022,"slug":"cve-2025-62265-liferay-portal-is-vulnerable-to-xss-in-the-blogs-widget","title":"Liferay Portal is vulnerable to XSS in the Blogs widget","severity":"medium","exploited":false,"published_at":"2025-10-30T19:16:35.49+00:00","url":"https://junglewise.ai/threats/cve-2025-62265-liferay-portal-is-vulnerable-to-xss-in-the-blogs-widget"},{"cve":"CVE-2025-62266","cvss":6.1,"epss":0.0023,"slug":"cve-2025-62266-liferay-portal-is-vulnerable-to-dns-rebinding-attacks","title":"Liferay Portal is vulnerable to DNS rebinding attacks","severity":"medium","exploited":false,"published_at":"2025-10-30T18:15:33.033+00:00","url":"https://junglewise.ai/threats/cve-2025-62266-liferay-portal-is-vulnerable-to-dns-rebinding-attacks"},{"cve":"CVE-2025-62257","cvss":5.3,"epss":0.0039,"slug":"cve-2025-62257-liferay-portal-vulnerable-to-password-enumeration","title":"Liferay Portal vulnerable to password enumeration","severity":"medium","exploited":false,"published_at":"2025-10-30T00:15:34.907+00:00","url":"https://junglewise.ai/threats/cve-2025-62257-liferay-portal-vulnerable-to-password-enumeration"},{"cve":"CVE-2025-62261","cvss":6.5,"epss":0.0029,"slug":"cve-2025-62261-liferay-portal-stores-password-reset-tokens-in-plain-text","title":"Liferay Portal Stores Password Reset Tokens in Plain Text","severity":"medium","exploited":false,"published_at":"2025-10-27T22:15:41.733+00:00","url":"https://junglewise.ai/threats/cve-2025-62261-liferay-portal-stores-password-reset-tokens-in-plain-text"},{"cve":"CVE-2025-62260","cvss":7.5,"epss":0.0039,"slug":"cve-2025-62260-liferay-portal-vulnerable-to-dos-via-crafted-headless-api-request","title":"Liferay Portal Vulnerable to DoS via Crafted Headless API Request","severity":"high","exploited":false,"published_at":"2025-10-27T22:15:41.59+00:00","url":"https://junglewise.ai/threats/cve-2025-62260-liferay-portal-vulnerable-to-dos-via-crafted-headless-api-request"},{"cve":"CVE-2025-62262","cvss":4.4,"epss":0.0014,"slug":"cve-2025-62262-liferay-portal-vulnerable-to-information-exposure-through-a-log","title":"Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature","severity":"medium","exploited":false,"published_at":"2025-10-27T21:15:37.577+00:00","url":"https://junglewise.ai/threats/cve-2025-62262-liferay-portal-vulnerable-to-information-exposure-through-a-log"},{"cve":"CVE-2025-62263","cvss":5.4,"epss":0.0022,"slug":"cve-2025-62263-liferay-portal-vulnerable-to-cross-site-scripting","title":"Liferay Portal Vulnerable to Cross-Site Scripting","severity":"medium","exploited":false,"published_at":"2025-10-27T20:15:54.603+00:00","url":"https://junglewise.ai/threats/cve-2025-62263-liferay-portal-vulnerable-to-cross-site-scripting"},{"cve":"CVE-2025-62253","cvss":6.1,"epss":0.0025,"slug":"cve-2025-62253-liferay-portal-vulnerable-to-open-redirect-via-the-com-liferay","title":"Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter","severity":"medium","exploited":false,"published_at":"2025-10-27T19:16:05.35+00:00","url":"https://junglewise.ai/threats/cve-2025-62253-liferay-portal-vulnerable-to-open-redirect-via-the-com-liferay"},{"cve":"CVE-2025-62254","cvss":7.5,"epss":0.0055,"slug":"cve-2025-62254-liferay-portal-comboservlet-denial-of-service-via-large-file","title":"Liferay Portal ComboServlet denial of service via large file combination","severity":"high","exploited":false,"published_at":"2025-10-23T23:15:37.7+00:00","url":"https://junglewise.ai/threats/cve-2025-62254-liferay-portal-comboservlet-denial-of-service-via-large-file"},{"cve":"CVE-2025-62255","cvss":6.1,"epss":0.0021,"slug":"cve-2025-62255-liferay-portal-self-cross-site-scripting-xss-vulnerability-on-the","title":"Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page","severity":"medium","exploited":false,"published_at":"2025-10-23T19:15:50.987+00:00","url":"https://junglewise.ai/threats/cve-2025-62255-liferay-portal-self-cross-site-scripting-xss-vulnerability-on-the"},{"cve":"CVE-2025-62256","cvss":5.3,"epss":0.0041,"slug":"cve-2025-62256-liferay-portal-and-dxp-do-not-properly-restrict-access-to-openapi","title":"Liferay Portal and DXP do not properly restrict access to OpenAPI","severity":"medium","exploited":false,"published_at":"2025-10-23T14:15:42.98+00:00","url":"https://junglewise.ai/threats/cve-2025-62256-liferay-portal-and-dxp-do-not-properly-restrict-access-to-openapi"},{"cve":"CVE-2025-62247","cvss":6.5,"epss":0.0027,"slug":"cve-2025-62247-liferay-portal-and-dxp-are-missing-authorization-in-collection","title":"Liferay Portal and DXP are Missing Authorization in Collection Provider","severity":"medium","exploited":false,"published_at":"2025-10-22T20:15:37.78+00:00","url":"https://junglewise.ai/threats/cve-2025-62247-liferay-portal-and-dxp-are-missing-authorization-in-collection"},{"cve":"CVE-2025-62248","cvss":4.8,"epss":0.0024,"slug":"cve-2025-62248-liferay-portal-and-liferay-dxp-vulnerable-to-reflected-cross-site","title":"A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.","severity":"medium","exploited":false,"published_at":"2025-10-22T19:15:35.987+00:00","url":"https://junglewise.ai/threats/cve-2025-62248-liferay-portal-and-liferay-dxp-vulnerable-to-reflected-cross-site"},{"cve":"CVE-2025-62249","cvss":6.1,"epss":0.0025,"slug":"cve-2025-62249-liferay-portal-reflected-cross-site-scripting-xss-vulnerability","title":"Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget","severity":"medium","exploited":false,"published_at":"2025-10-21T19:21:25.203+00:00","url":"https://junglewise.ai/threats/cve-2025-62249-liferay-portal-reflected-cross-site-scripting-xss-vulnerability"},{"cve":"CVE-2025-62250","cvss":6.5,"epss":0.0017,"slug":"cve-2025-62250-liferay-portal-fails-to-verify-messages-from-the-cluster-network","title":"Liferay Portal fails to verify messages from the cluster network is trusted","severity":"medium","exploited":false,"published_at":"2025-10-21T16:15:38.897+00:00","url":"https://junglewise.ai/threats/cve-2025-62250-liferay-portal-fails-to-verify-messages-from-the-cluster-network"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Liferay Portal","slug":"portal","vulnerabilities":22,"url":"https://junglewise.ai/threats/technologies/portal"}],"technology":{"hub":true,"name":"Liferay Digital Experience Platform","slug":"digital-experience-platform","vendor":{"hub":true,"name":"Liferay","slug":"liferay","url":"https://junglewise.ai/threats/vendors/liferay"},"aliases":[],"description":"Digital Experience Platform is Liferay's software suite for building and managing customer-facing digital experiences and portals.","url":"https://junglewise.ai/threats/technologies/digital-experience-platform"},"most_severe":[{"cve":"CVE-2025-62254","cvss":7.5,"epss":0.0055,"slug":"cve-2025-62254-liferay-portal-comboservlet-denial-of-service-via-large-file","title":"Liferay Portal ComboServlet denial of service via large file combination","severity":"high","exploited":false,"published_at":"2025-10-23T23:15:37.7+00:00","url":"https://junglewise.ai/threats/cve-2025-62254-liferay-portal-comboservlet-denial-of-service-via-large-file"},{"cve":"CVE-2025-62260","cvss":7.5,"epss":0.0039,"slug":"cve-2025-62260-liferay-portal-vulnerable-to-dos-via-crafted-headless-api-request","title":"Liferay Portal Vulnerable to DoS via Crafted Headless API Request","severity":"high","exploited":false,"published_at":"2025-10-27T22:15:41.59+00:00","url":"https://junglewise.ai/threats/cve-2025-62260-liferay-portal-vulnerable-to-dos-via-crafted-headless-api-request"},{"cve":"CVE-2025-62261","cvss":6.5,"epss":0.0029,"slug":"cve-2025-62261-liferay-portal-stores-password-reset-tokens-in-plain-text","title":"Liferay Portal Stores Password Reset Tokens in Plain Text","severity":"medium","exploited":false,"published_at":"2025-10-27T22:15:41.733+00:00","url":"https://junglewise.ai/threats/cve-2025-62261-liferay-portal-stores-password-reset-tokens-in-plain-text"},{"cve":"CVE-2025-62247","cvss":6.5,"epss":0.0027,"slug":"cve-2025-62247-liferay-portal-and-dxp-are-missing-authorization-in-collection","title":"Liferay Portal and DXP are Missing Authorization in Collection Provider","severity":"medium","exploited":false,"published_at":"2025-10-22T20:15:37.78+00:00","url":"https://junglewise.ai/threats/cve-2025-62247-liferay-portal-and-dxp-are-missing-authorization-in-collection"},{"cve":"CVE-2025-62250","cvss":6.5,"epss":0.0017,"slug":"cve-2025-62250-liferay-portal-fails-to-verify-messages-from-the-cluster-network","title":"Liferay Portal fails to verify messages from the cluster network is trusted","severity":"medium","exploited":false,"published_at":"2025-10-21T16:15:38.897+00:00","url":"https://junglewise.ai/threats/cve-2025-62250-liferay-portal-fails-to-verify-messages-from-the-cluster-network"},{"cve":"CVE-2025-62253","cvss":6.1,"epss":0.0025,"slug":"cve-2025-62253-liferay-portal-vulnerable-to-open-redirect-via-the-com-liferay","title":"Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter","severity":"medium","exploited":false,"published_at":"2025-10-27T19:16:05.35+00:00","url":"https://junglewise.ai/threats/cve-2025-62253-liferay-portal-vulnerable-to-open-redirect-via-the-com-liferay"},{"cve":"CVE-2025-62249","cvss":6.1,"epss":0.0025,"slug":"cve-2025-62249-liferay-portal-reflected-cross-site-scripting-xss-vulnerability","title":"Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget","severity":"medium","exploited":false,"published_at":"2025-10-21T19:21:25.203+00:00","url":"https://junglewise.ai/threats/cve-2025-62249-liferay-portal-reflected-cross-site-scripting-xss-vulnerability"},{"cve":"CVE-2025-62267","cvss":6.1,"epss":0.0023,"slug":"cve-2025-62267-liferay-portal-and-dxp-affected-by-multiple-cross-site-scripting","title":"Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal…","severity":"medium","exploited":false,"published_at":"2025-10-31T19:15:50.61+00:00","url":"https://junglewise.ai/threats/cve-2025-62267-liferay-portal-and-dxp-affected-by-multiple-cross-site-scripting"},{"cve":"CVE-2025-62266","cvss":6.1,"epss":0.0023,"slug":"cve-2025-62266-liferay-portal-is-vulnerable-to-dns-rebinding-attacks","title":"Liferay Portal is vulnerable to DNS rebinding attacks","severity":"medium","exploited":false,"published_at":"2025-10-30T18:15:33.033+00:00","url":"https://junglewise.ai/threats/cve-2025-62266-liferay-portal-is-vulnerable-to-dns-rebinding-attacks"},{"cve":"CVE-2025-62255","cvss":6.1,"epss":0.0021,"slug":"cve-2025-62255-liferay-portal-self-cross-site-scripting-xss-vulnerability-on-the","title":"Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page","severity":"medium","exploited":false,"published_at":"2025-10-23T19:15:50.987+00:00","url":"https://junglewise.ai/threats/cve-2025-62255-liferay-portal-self-cross-site-scripting-xss-vulnerability-on-the"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}