CVE-2025-14340

🗓️ 18 Feb 2026 13:39:11Reported by PayaraType

cve🔗 web.nvd.nist.gov👁 24 Views🌐 WEB

Admin account takeover via malicious URL payload exploiting cross-site scripting in Payara Server API.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2025-14340	10 Apr 202621:03	–	circl
CNNVD	Payara Server 安全漏洞	18 Feb 202600:00	–	cnnvd
Cvelist	CVE-2025-14340 Admin Account Takeover via malicious URL payload	18 Feb 202613:39	–	cvelist
Kitploit	CVE-2025-14340	5 Oct 202603:58	–	kitploit
Nuclei	Payara Server - Cross-Site Scripting	7 Oct 202602:15	–	nuclei
NVD	CVE-2025-14340	18 Feb 202614:16	–	nvd
Packet Storm	📄 Payara Server Cross Site Scripting	24 Mar 202600:00	–	packetstorm
Positive Technologies	PT-2026-20388	18 Feb 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2025-14340: Improper Neutralization of Input During Web Page Generation	18 Feb 202600:00	–	rapid7
RedhatCVE	CVE-2025-14340	19 Feb 202619:21	–	redhatcve

[
  {
    "defaultStatus": "unaffected",
    "product": "Payara Server",
    "vendor": "Payara Platform",
    "versions": [
      {
        "lessThanOrEqual": "4.1.2.191.53",
        "status": "affected",
        "version": "4.1.153.1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "5.82.0",
        "status": "affected",
        "version": "5.20.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "6.33.0",
        "status": "affected",
        "version": "6.0.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.2025.2",
        "status": "affected",
        "version": "7.2024.1.Alpha1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "6.2025.11",
        "status": "affected",
        "version": "6.2022.1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "5.2022.5",
        "status": "affected",
        "version": "5.2020.2",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "5.201.2",
        "status": "affected",
        "version": "5.181",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "4.1.2.191.54",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "5.83.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.34.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "7.2026.1",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
docs	www.docs.payara.fish/enterprise/docs/Security/Security%20Fix%20List.html

Parameter	Position	Path	Description	CWE
<PAYLOAD>	query param	management/domain/version	XSS via URL payload in the version endpoint allowing attacker-controlled script execution to trigger further actions.	CWE-79
id	request body	management/domain/change-admin-password	Password change endpoint accepts updates without current password and CSRF protection, enabling an attacker-controlled password change via a crafted request.	CWE-79
newpassword	request body	management/domain/change-admin-password	Password change endpoint accepts updates without current password and CSRF protection, enabling an attacker-controlled password change via a crafted request.	CWE-79
password	request body	management/domain/change-admin-password	Password change endpoint accepts updates without current password and CSRF protection, enabling an attacker-controlled password change via a crafted request.	CWE-79
__remove_empty_entries__	request body	management/domain/change-admin-password	Password change endpoint accepts updates without current password and CSRF protection, enabling an attacker-controlled password change via a crafted request.	CWE-79

17 Jun 2026 08:35Current

5.8Medium risk

Vulners AI Score5.8

CVSS 49.3

EPSS0.01025

SSVC

CWE-79