Exploitation Summary
EIP tracks 1 public exploit for CVE-2019-16891. PoCs published by rai0ffs3c.
AI-analyzed exploit summary The repository contains only a README file with minimal content, lacking any exploit code or technical details about CVE-2019-16891. No functional PoC or analysis is provided.
Description
Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.
Exploits (1)
nomisec
STUB
by rai0ffs3c · poc
https://github.com/rai0ffs3c/CVE-2019-16891-Liferay-deserialization-RCE
The repository contains only a README file with minimal content, lacking any exploit code or technical details about CVE-2019-16891. No functional PoC or analysis is provided.
Classification
Stub 90%
Attack Type
Deserialization
Complexity
Theoretical
Reliability
Theoretical
Target:
Liferay Portal
No auth needed
devstral-2 · analyzed Feb 19, 2026
Full analysis →
References (4)
Core 4
Core References
Exploit, Third Party Advisory
https://dappsec.substack.com/p/an-advisory-for-cve-2019-16891-from
Exploit, Third Party Advisory
https://sec.vnpt.vn/2019/09/liferay-deserialization-json-deserialization-part-4/
Product, Release Notes
https://www.liferay.com/downloads-community
Scores
CVSS v3
9.8
EPSS
0.4565
EPSS Percentile
98.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-502
Status
published
Products (12)
com.liferay.portal/release.portal.bom
0 - 7.1.1Maven
liferay/liferay_portal
6.1.0 b1 (6 CPE variants)
liferay/liferay_portal
6.1.1 ga2
liferay/liferay_portal
6.1.2 ga3
liferay/liferay_portal
6.2.0 b1 (15 CPE variants)
liferay/liferay_portal
6.2.1 ga2
liferay/liferay_portal
6.2.2 ga3
liferay/liferay_portal
6.2.3 ga4
liferay/liferay_portal
6.2.4 ga5
liferay/liferay_portal
6.2.5 ga6
... and 2 more
Published
Oct 04, 2019
Tracked Since
Feb 18, 2026