# Liferay Portal vulnerabilities Source: https://junglewise.ai/threats/technologies/portal Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/portal.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 22 vulnerabilities in Liferay Portal: 0 in the last 7 days and 0 in the last 90 days, 2 of them critical and 1 exploited in the wild. The most recent, CVE-2025-62275, was published on 1 November 2025. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 22 (2 critical, 1 exploited in the wild) ## About Liferay Portal Liferay Portal is an open-source enterprise portal and content management system. ## Latest Liferay Portal vulnerabilities - [CVE-2025-62275: Liferay Portal and DXP do not check permissions of images in a blog entry](https://junglewise.ai/threats/cve-2025-62275-liferay-portal-and-dxp-do-not-check-permissions-of-images-in-a) (medium, CVSS 5.3, published 1 Nov 2025) - [CVE-2025-62276: Liferay Portal and DXP use an incorrect cache-control header](https://junglewise.ai/threats/cve-2025-62276-liferay-portal-and-dxp-use-an-incorrect-cache-control-header) (medium, CVSS 5.5, published 1 Nov 2025) - [CVE-2025-62267: Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal…](https://junglewise.ai/threats/cve-2025-62267-liferay-portal-and-dxp-affected-by-multiple-cross-site-scripting) (medium, CVSS 6.1, published 31 Oct 2025) - [CVE-2025-62265: Liferay Portal is vulnerable to XSS in the Blogs widget](https://junglewise.ai/threats/cve-2025-62265-liferay-portal-is-vulnerable-to-xss-in-the-blogs-widget) (medium, CVSS 5.4, published 30 Oct 2025) - [CVE-2025-62266: Liferay Portal is vulnerable to DNS rebinding attacks](https://junglewise.ai/threats/cve-2025-62266-liferay-portal-is-vulnerable-to-dns-rebinding-attacks) (medium, CVSS 6.1, published 30 Oct 2025) - [CVE-2025-62257: Liferay Portal vulnerable to password enumeration](https://junglewise.ai/threats/cve-2025-62257-liferay-portal-vulnerable-to-password-enumeration) (medium, CVSS 5.3, published 30 Oct 2025) - [CVE-2025-62261: Liferay Portal Stores Password Reset Tokens in Plain Text](https://junglewise.ai/threats/cve-2025-62261-liferay-portal-stores-password-reset-tokens-in-plain-text) (medium, CVSS 6.5, published 27 Oct 2025) - [CVE-2025-62260: Liferay Portal Vulnerable to DoS via Crafted Headless API Request](https://junglewise.ai/threats/cve-2025-62260-liferay-portal-vulnerable-to-dos-via-crafted-headless-api-request) (high, CVSS 7.5, published 27 Oct 2025) - [CVE-2025-62262: Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature](https://junglewise.ai/threats/cve-2025-62262-liferay-portal-vulnerable-to-information-exposure-through-a-log) (medium, CVSS 4.4, published 27 Oct 2025) - [CVE-2025-62263: Liferay Portal Vulnerable to Cross-Site Scripting](https://junglewise.ai/threats/cve-2025-62263-liferay-portal-vulnerable-to-cross-site-scripting) (medium, CVSS 5.4, published 27 Oct 2025) - [CVE-2025-62253: Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect…](https://junglewise.ai/threats/cve-2025-62253-liferay-portal-vulnerable-to-open-redirect-via-the-com-liferay) (medium, CVSS 6.1, published 27 Oct 2025) - [CVE-2025-62254: Liferay Portal ComboServlet denial of service via large file combination](https://junglewise.ai/threats/cve-2025-62254-liferay-portal-comboservlet-denial-of-service-via-large-file) (high, CVSS 7.5, published 23 Oct 2025) - [CVE-2025-62255: Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page](https://junglewise.ai/threats/cve-2025-62255-liferay-portal-self-cross-site-scripting-xss-vulnerability-on-the) (medium, CVSS 6.1, published 23 Oct 2025) - [CVE-2025-62256: Liferay Portal and DXP do not properly restrict access to OpenAPI](https://junglewise.ai/threats/cve-2025-62256-liferay-portal-and-dxp-do-not-properly-restrict-access-to-openapi) (medium, CVSS 5.3, published 23 Oct 2025) - [CVE-2025-62247: Liferay Portal and DXP are Missing Authorization in Collection Provider](https://junglewise.ai/threats/cve-2025-62247-liferay-portal-and-dxp-are-missing-authorization-in-collection) (medium, CVSS 6.5, published 22 Oct 2025) - [CVE-2025-62248: A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal…](https://junglewise.ai/threats/cve-2025-62248-liferay-portal-and-liferay-dxp-vulnerable-to-reflected-cross-site) (medium, CVSS 4.8, published 22 Oct 2025) - [CVE-2025-62249: Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget](https://junglewise.ai/threats/cve-2025-62249-liferay-portal-reflected-cross-site-scripting-xss-vulnerability) (medium, CVSS 6.1, published 21 Oct 2025) - [CVE-2025-62250: Liferay Portal fails to verify messages from the cluster network is trusted](https://junglewise.ai/threats/cve-2025-62250-liferay-portal-fails-to-verify-messages-from-the-cluster-network) (medium, CVSS 6.5, published 21 Oct 2025) - [CVE-2025-43761: Liferay Portal Reflected XSS in CKEditor component](https://junglewise.ai/threats/cve-2025-43761-liferay-portal-reflected-xss-in-ckeditor-component) (medium, CVSS 4, published 22 Aug 2025) - [CVE-2020-7961: Deserialization of Untrusted Data in Liferay Portal](https://junglewise.ai/threats/cve-2020-7961-liferay-portal-deserialization-of-untrusted-data-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 24 May 2022) - [CVE-2016-6517: Liferay Portal directory traversal in barebone.jsp](https://junglewise.ai/threats/cve-2016-6517-liferay-portal-directory-traversal-in-barebone-jsp) (critical, CVSS 9.8, published 23 Jan 2017) - [CVE-2010-5327: Liferay Portal remote code execution via Velocity template](https://junglewise.ai/threats/cve-2010-5327-liferay-portal-remote-code-execution-via-velocity-template) (high, CVSS 8.8, published 13 Jan 2017) ## Most severe Liferay Portal vulnerabilities - [CVE-2020-7961: Deserialization of Untrusted Data in Liferay Portal](https://junglewise.ai/threats/cve-2020-7961-liferay-portal-deserialization-of-untrusted-data-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 24 May 2022) - [CVE-2016-6517: Liferay Portal directory traversal in barebone.jsp](https://junglewise.ai/threats/cve-2016-6517-liferay-portal-directory-traversal-in-barebone-jsp) (critical, CVSS 9.8, published 23 Jan 2017) - [CVE-2010-5327: Liferay Portal remote code execution via Velocity template](https://junglewise.ai/threats/cve-2010-5327-liferay-portal-remote-code-execution-via-velocity-template) (high, CVSS 8.8, published 13 Jan 2017) - [CVE-2025-62254: Liferay Portal ComboServlet denial of service via large file combination](https://junglewise.ai/threats/cve-2025-62254-liferay-portal-comboservlet-denial-of-service-via-large-file) (high, CVSS 7.5, published 23 Oct 2025) - [CVE-2025-62260: Liferay Portal Vulnerable to DoS via Crafted Headless API Request](https://junglewise.ai/threats/cve-2025-62260-liferay-portal-vulnerable-to-dos-via-crafted-headless-api-request) (high, CVSS 7.5, published 27 Oct 2025) - [CVE-2025-62261: Liferay Portal Stores Password Reset Tokens in Plain Text](https://junglewise.ai/threats/cve-2025-62261-liferay-portal-stores-password-reset-tokens-in-plain-text) (medium, CVSS 6.5, published 27 Oct 2025) - [CVE-2025-62247: Liferay Portal and DXP are Missing Authorization in Collection Provider](https://junglewise.ai/threats/cve-2025-62247-liferay-portal-and-dxp-are-missing-authorization-in-collection) (medium, CVSS 6.5, published 22 Oct 2025) - [CVE-2025-62250: Liferay Portal fails to verify messages from the cluster network is trusted](https://junglewise.ai/threats/cve-2025-62250-liferay-portal-fails-to-verify-messages-from-the-cluster-network) (medium, CVSS 6.5, published 21 Oct 2025) - [CVE-2025-62253: Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect…](https://junglewise.ai/threats/cve-2025-62253-liferay-portal-vulnerable-to-open-redirect-via-the-com-liferay) (medium, CVSS 6.1, published 27 Oct 2025) - [CVE-2025-62249: Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget](https://junglewise.ai/threats/cve-2025-62249-liferay-portal-reflected-cross-site-scripting-xss-vulnerability) (medium, CVSS 6.1, published 21 Oct 2025) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Liferay technologies - [Liferay Digital Experience Platform](https://junglewise.ai/threats/technologies/digital-experience-platform): 18 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Liferay Portal vulnerabilities", https://junglewise.ai/threats/technologies/portal, 10 November 2026.