XSS exists in Liferay Portal prior to 7.0 CE GA4 via a login name, password, or e-mail address.
liferay liferay portal