CVE-2010-5327

Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.

• CWE-264

• https://dev.liferay.com/web/community-security-team/known-vulnerabilitiesPatch, Vendor Advisory
• https://dev.liferay.com/web/community-security-team/known-vulnerabilities/-/asset_publisher/4AHAYapUm8Xc/content/lps-64547-remote-code-execution-and-privilege-escalation-in-templatesPatch, Vendor Advisory
• https://github.com/liferay/liferay-portal/commit/90c4e85a8f8135f069f3f05e4d54a77704769f91Issue Tracking, Patch
• https://issues.liferay.com/browse/LPE-14964Issue Tracking
• https://issues.liferay.com/browse/LPS-64547Issue Tracking
• https://issues.liferay.com/browse/LPS-7087Issue Tracking
• https://dev.liferay.com/web/community-security-team/known-vulnerabilitiesPatch, Vendor Advisory
• https://dev.liferay.com/web/community-security-team/known-vulnerabilities/-/asset_publisher/4AHAYapUm8Xc/content/lps-64547-remote-code-execution-and-privilege-escalation-in-templatesPatch, Vendor Advisory
• https://github.com/liferay/liferay-portal/commit/90c4e85a8f8135f069f3f05e4d54a77704769f91Issue Tracking, Patch
• https://issues.liferay.com/browse/LPE-14964Issue Tracking
• https://issues.liferay.com/browse/LPS-64547Issue Tracking
• https://issues.liferay.com/browse/LPS-7087Issue Tracking

Published

Jan 13, 2017

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-5321Memory leak in drivers/media/video/videobuf-core.c in the vi…4.3
• CVE-2010-5322Cross-site scripting (XSS) vulnerability in ZeusCart 4.0 and…
• CVE-2010-5323Directory traversal vulnerability in UploadServlet in the Re…
• CVE-2010-5324Directory traversal vulnerability in UploadServlet in the Re…
• CVE-2010-5325Heap-based buffer overflow in the unhtmlify function in foom…
• CVE-2010-5326The Invoker Servlet on SAP NetWeaver Application Server Java…10
• CVE-2010-5328include/linux/init_task.h in the Linux kernel before 2.6.35 …
• CVE-2010-5329The video_usercopy function in drivers/media/video/v4l2-ioct…
• CVE-2010-5330On certain Ubiquiti devices, Command Injection exists via a …9.8
• CVE-2010-5331In the Linux kernel before 2.6.34, a range check issue in dr…7.8
• CVE-2010-5332In the Linux kernel before 2.6.37, an out of bounds array ac…5.6
• CVE-2010-5333The web server in Integard Pro and Home before 2.0.0.9037 an…9.8