Dxp
Vendor:
First CVE: May 16, 2021 · Active for 5 years
43
Total CVEs
More Total CVEs than 98% of tracked products
8.6
Avg CVEs / Year
Higher CVE frequency than 95% of tracked products
6.3
Avg CVSS
Higher Avg CVSS than 31% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Dxp over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 16, 2021
5 years ago
Most Recent CVE
Oct 13, 2025
288 days ago
CVE Severity & Scoring
Dxp43 CVEs
81%
14%
All CVEs353,173 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network43 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low42 (97.7%)
High1 (2.3%)
Unknown0 (0.0%)
User Interaction
None16 (37.2%)
Unknown0 (0.0%)
Required27 (62.8%)
Privileges Required
Low16 (37.2%)
High0 (0.0%)
None27 (62.8%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (43 CVEs).
43 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-42120CRITICAL A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to exe | Nov 15, 2022 | 9.8 | 33 | NO | NO |
CVE-2022-42118MEDIUM A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7. | Nov 15, 2022 | 6.1 | 33 | NO | YES |
CVE-2022-42122CRITICAL A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands | Nov 15, 2022 | 9.8 | 32 | NO | NO |
CVE-2022-42121HIGH A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack | Nov 15, 2022 | 8.8 | 30 | NO | NO |
CVE-2021-29053HIGH Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the clas | May 17, 2021 | 8.8 | 28 | NO | NO |
CVE-2021-29047HIGH The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote atta | May 16, 2021 | 7.5 | 26 | NO | NO |
CVE-2022-38512MEDIUM The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web cont | Sep 22, 2022 | 6.5 | 25 | NO | NO |
CVE-2025-43798MEDIUM Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be used multiple times dur | Sep 15, 2025 | 6.5 | 24 | NO | NO |
CVE-2023-35030HIGH Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allow | Jun 15, 2023 | 8.8 | 24 | NO | NO |
CVE-2022-42113MEDIUM A Cross-site scripting (XSS) vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote att | Oct 18, 2022 | 6.1 | 24 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (43 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
2.3% of CVEs· 97th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (43 CVEs).
Media Mentions
Signals from CVEs in this product scope (43 CVEs).
Top CNAs Publishing CVEs For Dxp
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 7.4 | 15 | 5.8 | 0.5% | 0 | 0 |
| 7.3 | 32 | 5.9 | 0.6% | 0 | 1 |