CVE-2021-33990

Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the exploit reference link only shows frmfolders.html is accessible and does not demonstrate how an unauthorized user can upload a file.

• CWE-281
• CWE-78

• http://packetstormsecurity.com/files/171701/Liferay-Portal-6.2.5-Insecure-Permissions.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/fu2x2000/Liferay_exploit_PocExploit, Third Party Advisory
• http://packetstormsecurity.com/files/171701/Liferay-Portal-6.2.5-Insecure-Permissions.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/fu2x2000/Liferay_exploit_PocExploit, Third Party Advisory

Published

Apr 16, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33975Buffer Overflow vulnerability in Qihoo 360 Total Security v1…10
• CVE-2021-3398Stormshield Network Security (SNS) 3.x has an Integer Overfl…5.8
• CVE-2021-33981An insecure, direct object vulnerability in hunting/fishing …4.3
• CVE-2021-33982An insufficient session expiration vulnerability exists in t…7.5
• CVE-2021-33983Buffer Overflow vulnerability in Dvidelabs flatcc v.0.6.0 al…7.8
• CVE-2021-33988Cross Site Scripting (XSS). vulnerability exists in Microweb…6.1
• CVE-2021-3401Bitcoin Core before 0.19.0 might allow remote attackers to e…9.8
• CVE-2021-3402An integer overflow and several buffer overflow reads in lib…9.1
• CVE-2021-3403In ytnef 1.9.3, the TNEFSubjectHandler function in lib/ytnef…7.8
• CVE-2021-3404In ytnef 1.9.3, the SwapWord function in lib/ytnef.c allows …7.8
• CVE-2021-3405A flaw was found in libebml before 1.4.2. A heap overflow bu…6.5
• CVE-2021-34055jhead 3.06 is vulnerable to Buffer Overflow via exif.c in fu…7.8