CVE-2020-7934

In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will then be rendered when a user utilizes the search feature to search for other users (i.e., if a user with modified fields occurs in the search results). This issue was fixed in Liferay Portal CE version 7.3.0 GA1.

• CWE-79

• http://packetstormsecurity.com/files/160168/LifeRay-7.2.1-GA2-Cross-Site-Scripting.html
• https://github.com/3ndG4me/liferay-xss-7.2.1GA2-poc-report-CVE-2020-7934
• https://semanticbits.com/liferay-portal-authenticated-xss-disclosure/Third Party Advisory
• http://packetstormsecurity.com/files/160168/LifeRay-7.2.1-GA2-Cross-Site-Scripting.html
• https://github.com/3ndG4me/liferay-xss-7.2.1GA2-poc-report-CVE-2020-7934
• https://semanticbits.com/liferay-portal-authenticated-xss-disclosure/Third Party Advisory

Published

Jan 28, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7926A user authorized to perform database queries may cause deni…6.5
• CVE-2020-7927Specially crafted API calls may allow an authenticated user …6.5
• CVE-2020-7928A user authorized to perform database queries may trigger a …6.5
• CVE-2020-7929A user authorized to perform database queries may trigger de…6.5
• CVE-2020-7931In JFrog Artifactory 5.x and 6.x, insecure FreeMarker templa…8.8
• CVE-2020-7932OMERO.web before 5.6.3 optionally allows sensitive data elem…5.7
• CVE-2020-7935Artica Pandora FMS through 7.42 is vulnerable to remote PHP …7.2
• CVE-2020-7936An open redirect on the login form (and possibly other place…6.1
• CVE-2020-7937An XSS issue in the title field in Plone 5.0 through 5.2.1 a…5.4
• CVE-2020-7938plone.restapi in Plone 5.2.0 through 5.2.1 allows users with…8.8
• CVE-2020-7939SQL Injection in DTML or in connection objects in Plone 4.0 …8.8
• CVE-2020-7940Missing password strength checks on some forms in Plone 4.3 …7.5