Description
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 has a security vulnerability that allowing for improper access through the expandoTableLocalService.
Remediation
References
Related Vulnerabilities
Python Improper Preservation of Permissions Vulnerability (CVE-2026-4360)
WordPress Plugin LeagueManager Multiple Cross-Site Scripting Vulnerabilities (3.7)
MediaWiki CVE-2021-30159 Vulnerability (CVE-2021-30159)
WordPress Plugin Nmedia WordPress Member Conversation 'doupload.php' Arbitrary File Upload (1.3)
Oracle Database Server CVE-2012-0082 Vulnerability (CVE-2012-0082)