GCVE - cpe:2.3:a:liferay:dxp:7.4:ga1:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:liferay:dxp:7.4:ga1:*:*:*:*:*:*

part: a version: 7.4 update: ga1

Vendor	Liferay (`5231553d-d54f-5cd9-bf56-0bf2ac7f0033`)
Product	Dxp (`3a78ccbe-3312-579d-a5a1-5eda84a793d3`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-42121`	vulnerable	2026-06-08 05:49:29.368522	Details available A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field. Published: 2022-11-15T00:00:00.000Z Updated: 2026-07-09T00:21:51.699Z Open on db.gcve.eu Reference links https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42121 https://issues.liferay.com/browse/LPE-17414	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-42117`	vulnerable	2026-06-08 05:49:29.328849	Details available A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML. Published: 2022-10-18T00:00:00.000Z Updated: 2026-07-09T00:21:46.773Z Open on db.gcve.eu Reference links https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42117	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-42116`	vulnerable	2026-06-08 05:49:29.323937	Details available A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the (1) name, or (2) namespace parameter. Published: 2022-10-18T00:00:00.000Z Updated: 2026-07-09T00:21:45.544Z Open on db.gcve.eu Reference links https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42116	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-42114`	vulnerable	2026-06-08 05:49:29.308833	Details available A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and Liferay DXP 7.4 before update 37 allows remote attackers to inject arbitrary web script or HTML. Published: 2022-10-18T00:00:00.000Z Updated: 2026-07-09T00:21:43.101Z Open on db.gcve.eu Reference links https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42114	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-42112`	vulnerable	2026-06-08 05:49:29.280786	Details available A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload. Published: 2022-10-18T00:00:00.000Z Updated: 2026-07-09T00:21:40.639Z Open on db.gcve.eu Reference links https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42112	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.