CVE-2025-14340
Lifecycle Timeline
2Tags
Description
Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.
Analysis
Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.
Technical Context
Classified as CWE-79 (Cross-site Scripting (XSS)). Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.
Affected Products
Component: REST Management.
Remediation
Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today