Liferay Digital Experience Platform (DXP) 7.0 Fix Pack 76

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_76:*:*:*:*:*:*

part: a version: 7.0 update: fix_pack_76

VendorLiferay (5231553d-d54f-5cd9-bf56-0bf2ac7f0033)
ProductDigital Experience Platform (ff76fa00-2b41-514b-9b5f-2ad7f4e73e64)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2023-42628 vulnerable 2026-06-08 06:11:08.741970 Details available
CRITICAL (9)
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
Published: 2023-10-17T11:52:45.867Z
Updated: 2024-08-02T19:23:40.284Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-42132 vulnerable 2026-06-08 05:49:29.478911 Details available
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
Published: 2022-11-15T00:00:00.000Z
Updated: 2026-07-09T00:22:05.233Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-28978 vulnerable 2026-06-08 05:42:46.249149 Details available
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
Published: 2022-09-21T23:38:59.000Z
Updated: 2026-07-09T00:18:43.181Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-26596 vulnerable 2026-06-08 05:41:52.573290 Details available
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
Published: 2022-04-25T15:41:28.000Z
Updated: 2026-07-09T00:18:02.597Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-38266 vulnerable 2026-06-08 05:32:55.800261 Details available
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.
Published: 2022-03-02T23:00:44.000Z
Updated: 2026-07-09T00:14:37.927Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-38263 vulnerable 2026-06-08 05:32:55.758301 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33334 vulnerable 2026-06-08 05:32:11.295374 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33333 vulnerable 2026-06-08 05:32:11.289437 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33331 vulnerable 2026-06-08 05:32:11.281498 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33328 vulnerable 2026-06-08 05:32:11.274990 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33326 vulnerable 2026-06-08 05:32:11.255407 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33325 vulnerable 2026-06-08 05:32:11.222143 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33322 vulnerable 2026-06-08 05:32:11.189871 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33320 vulnerable 2026-06-08 05:32:11.157921 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29049 vulnerable 2026-06-08 05:31:25.570271 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29044 vulnerable 2026-06-08 05:31:25.525724 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29043 vulnerable 2026-06-08 05:31:25.504784 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29040 vulnerable 2026-06-08 05:31:25.462862 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-15842 vulnerable 2026-06-08 05:19:27.021745 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-15841 vulnerable 2026-06-08 05:19:26.992872 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.