# Liferay Digital Experience Platform vulnerabilities

Source: https://junglewise.ai/threats/technologies/digital-experience-platform  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/digital-experience-platform.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 18 vulnerabilities in Liferay Digital Experience Platform: 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2025-62275, was published on 1 November 2025.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 0
- All time: 18 (0 critical, 0 exploited in the wild)

## About Liferay Digital Experience Platform

Digital Experience Platform is Liferay's software suite for building and managing customer-facing digital experiences and portals.

## Latest Liferay Digital Experience Platform vulnerabilities

- [CVE-2025-62275: Liferay Portal and DXP do not check permissions of images in a blog entry](https://junglewise.ai/threats/cve-2025-62275-liferay-portal-and-dxp-do-not-check-permissions-of-images-in-a) (medium, CVSS 5.3, published 1 Nov 2025)
- [CVE-2025-62276: Liferay Portal and DXP use an incorrect cache-control header](https://junglewise.ai/threats/cve-2025-62276-liferay-portal-and-dxp-use-an-incorrect-cache-control-header) (medium, CVSS 5.5, published 1 Nov 2025)
- [CVE-2025-62267: Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal…](https://junglewise.ai/threats/cve-2025-62267-liferay-portal-and-dxp-affected-by-multiple-cross-site-scripting) (medium, CVSS 6.1, published 31 Oct 2025)
- [CVE-2025-62265: Liferay Portal is vulnerable to XSS in the Blogs widget](https://junglewise.ai/threats/cve-2025-62265-liferay-portal-is-vulnerable-to-xss-in-the-blogs-widget) (medium, CVSS 5.4, published 30 Oct 2025)
- [CVE-2025-62266: Liferay Portal is vulnerable to DNS rebinding attacks](https://junglewise.ai/threats/cve-2025-62266-liferay-portal-is-vulnerable-to-dns-rebinding-attacks) (medium, CVSS 6.1, published 30 Oct 2025)
- [CVE-2025-62257: Liferay Portal vulnerable to password enumeration](https://junglewise.ai/threats/cve-2025-62257-liferay-portal-vulnerable-to-password-enumeration) (medium, CVSS 5.3, published 30 Oct 2025)
- [CVE-2025-62261: Liferay Portal Stores Password Reset Tokens in Plain Text](https://junglewise.ai/threats/cve-2025-62261-liferay-portal-stores-password-reset-tokens-in-plain-text) (medium, CVSS 6.5, published 27 Oct 2025)
- [CVE-2025-62260: Liferay Portal Vulnerable to DoS via Crafted Headless API Request](https://junglewise.ai/threats/cve-2025-62260-liferay-portal-vulnerable-to-dos-via-crafted-headless-api-request) (high, CVSS 7.5, published 27 Oct 2025)
- [CVE-2025-62262: Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature](https://junglewise.ai/threats/cve-2025-62262-liferay-portal-vulnerable-to-information-exposure-through-a-log) (medium, CVSS 4.4, published 27 Oct 2025)
- [CVE-2025-62263: Liferay Portal Vulnerable to Cross-Site Scripting](https://junglewise.ai/threats/cve-2025-62263-liferay-portal-vulnerable-to-cross-site-scripting) (medium, CVSS 5.4, published 27 Oct 2025)
- [CVE-2025-62253: Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect…](https://junglewise.ai/threats/cve-2025-62253-liferay-portal-vulnerable-to-open-redirect-via-the-com-liferay) (medium, CVSS 6.1, published 27 Oct 2025)
- [CVE-2025-62254: Liferay Portal ComboServlet denial of service via large file combination](https://junglewise.ai/threats/cve-2025-62254-liferay-portal-comboservlet-denial-of-service-via-large-file) (high, CVSS 7.5, published 23 Oct 2025)
- [CVE-2025-62255: Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page](https://junglewise.ai/threats/cve-2025-62255-liferay-portal-self-cross-site-scripting-xss-vulnerability-on-the) (medium, CVSS 6.1, published 23 Oct 2025)
- [CVE-2025-62256: Liferay Portal and DXP do not properly restrict access to OpenAPI](https://junglewise.ai/threats/cve-2025-62256-liferay-portal-and-dxp-do-not-properly-restrict-access-to-openapi) (medium, CVSS 5.3, published 23 Oct 2025)
- [CVE-2025-62247: Liferay Portal and DXP are Missing Authorization in Collection Provider](https://junglewise.ai/threats/cve-2025-62247-liferay-portal-and-dxp-are-missing-authorization-in-collection) (medium, CVSS 6.5, published 22 Oct 2025)
- [CVE-2025-62248: A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal…](https://junglewise.ai/threats/cve-2025-62248-liferay-portal-and-liferay-dxp-vulnerable-to-reflected-cross-site) (medium, CVSS 4.8, published 22 Oct 2025)
- [CVE-2025-62249: Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget](https://junglewise.ai/threats/cve-2025-62249-liferay-portal-reflected-cross-site-scripting-xss-vulnerability) (medium, CVSS 6.1, published 21 Oct 2025)
- [CVE-2025-62250: Liferay Portal fails to verify messages from the cluster network is trusted](https://junglewise.ai/threats/cve-2025-62250-liferay-portal-fails-to-verify-messages-from-the-cluster-network) (medium, CVSS 6.5, published 21 Oct 2025)

## Most severe Liferay Digital Experience Platform vulnerabilities

- [CVE-2025-62254: Liferay Portal ComboServlet denial of service via large file combination](https://junglewise.ai/threats/cve-2025-62254-liferay-portal-comboservlet-denial-of-service-via-large-file) (high, CVSS 7.5, published 23 Oct 2025)
- [CVE-2025-62260: Liferay Portal Vulnerable to DoS via Crafted Headless API Request](https://junglewise.ai/threats/cve-2025-62260-liferay-portal-vulnerable-to-dos-via-crafted-headless-api-request) (high, CVSS 7.5, published 27 Oct 2025)
- [CVE-2025-62261: Liferay Portal Stores Password Reset Tokens in Plain Text](https://junglewise.ai/threats/cve-2025-62261-liferay-portal-stores-password-reset-tokens-in-plain-text) (medium, CVSS 6.5, published 27 Oct 2025)
- [CVE-2025-62247: Liferay Portal and DXP are Missing Authorization in Collection Provider](https://junglewise.ai/threats/cve-2025-62247-liferay-portal-and-dxp-are-missing-authorization-in-collection) (medium, CVSS 6.5, published 22 Oct 2025)
- [CVE-2025-62250: Liferay Portal fails to verify messages from the cluster network is trusted](https://junglewise.ai/threats/cve-2025-62250-liferay-portal-fails-to-verify-messages-from-the-cluster-network) (medium, CVSS 6.5, published 21 Oct 2025)
- [CVE-2025-62253: Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect…](https://junglewise.ai/threats/cve-2025-62253-liferay-portal-vulnerable-to-open-redirect-via-the-com-liferay) (medium, CVSS 6.1, published 27 Oct 2025)
- [CVE-2025-62249: Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget](https://junglewise.ai/threats/cve-2025-62249-liferay-portal-reflected-cross-site-scripting-xss-vulnerability) (medium, CVSS 6.1, published 21 Oct 2025)
- [CVE-2025-62267: Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal…](https://junglewise.ai/threats/cve-2025-62267-liferay-portal-and-dxp-affected-by-multiple-cross-site-scripting) (medium, CVSS 6.1, published 31 Oct 2025)
- [CVE-2025-62266: Liferay Portal is vulnerable to DNS rebinding attacks](https://junglewise.ai/threats/cve-2025-62266-liferay-portal-is-vulnerable-to-dns-rebinding-attacks) (medium, CVSS 6.1, published 30 Oct 2025)
- [CVE-2025-62255: Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page](https://junglewise.ai/threats/cve-2025-62255-liferay-portal-self-cross-site-scripting-xss-vulnerability-on-the) (medium, CVSS 6.1, published 23 Oct 2025)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other Liferay technologies

- [Liferay Portal](https://junglewise.ai/threats/technologies/portal): 22 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Liferay Digital Experience Platform vulnerabilities", https://junglewise.ai/threats/technologies/digital-experience-platform, 9 November 2026.