CVEvulnerability

CVE-2025-14340

7.3 HIGH Published 2026-02-18 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2026-02-18
Last modified
2026-06-17
Assigner
769c9ae7-73c3-4e47-ae19-903170fc3eb8
CVSS 4.0 (769c9ae7-73c3-4e47-ae19-903170fc3eb8)
7.3 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:U/V:X/RE:M/U:Red
Weaknesses
CWE-79

Description

Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References