payara__Payara_CVE-2022-37422_5-2022-2

Payara 플랫폼 커뮤니티 에디션 창조하세요. 혁신하세요. 도약하세요. Payara 플랫폼 커뮤니티 에디션은 개발 프로젝트와 컨테이너화된 Jakarta EE 및 MicroProfile 애플리케이션을 위한 오픈 소스 서버 런타임을 제공합니다. Payara Server Community 는 온프레미스, 클라우드 또는 하이브리드 등 모든 환경에서 Jakarta EEJava EE 애플리케이션을 지원하는, 개발 프로젝트를 위한 클라우드 네이티브 혁신적 오픈 소스 미들웨어 플랫폼입니다. Payara Micro Community 는 개발...

Payara Server - Cross-Site Scripting

Payara Server versions 4.1.2.191.54, 5.83.0, 6.34.0, and 7.2026.1 contain a stored XSS vulnerability caused by improper input sanitization in the REST Management Interface. This allows attackers to mislead administrators into changing the admin password via a URL payload; however, the exploit...

MAL-012

MAL-012: Payara Server Admin Console의 반사형 크로스 사이트 스크립팅으로 인한 원격 코드 실행 Payara Admin Console에서 반사형 크로스 사이트 스크립팅XSS 공격이 발견되었습니다. 관리자 사용자가 악성 URL에 접속하고 “Choose File” 버튼을 클릭하도록 유도함으로써, 공격자는 임의의 JavaScript 코드를 실행하여 사용자를 사칭하고 관리자 기능을 악의적인 목적으로 악용할 수 있습니다. XSS가 Payara Admin Console에 존재하기 때문에, 공격자는 이를 사용하여...

Payara Micro Community 5.2021.6 Directory Traversal

Payara Micro Community 5.2021.6 and below contains a directory traversal vulnerability. id: CVE-2021-41381 info: name: Payara Micro Community 5.2021.6 Directory Traversal author: pikpikcu severity: high description: Payara Micro Community 5.2021.6 and below contains a directory traversal...

CVE-2021-41381

CVE-2021-41381 Payara Micro Community 5.2021.6 - ディレクトリトラバーサルに対するPOCを作成しました。上記の参照フィールドを参照してください。...

CVE-2022-22965-PoC_Payara

CVE-2022-22965 PoC - Payara 임의 파일 다운로드 Payara/Glassfish에서 CVE-2022-22965 Spring 취약점을 재현하는 최소 예제입니다. 악의적인 사용자가 임의의 웹 루트를 설정하여 임의의 파일 다운로드를 가능하게 하는 Payara/Glassfish용 대체 페이로드입니다. Docker Compose를 사용한 실행 1. Docker Compose를 사용하여 애플리케이션 빌드 root@kitploit: docker-compose up --build 2. 앱을 테스트하려면...

CVE-2025-14340

XSSによる管理者アカウント乗っ取り CVE-2025-14340 Payaraの管理RESTインターフェースにおけるクロスサイトスクリプティングの脆弱性により、攻撃者が制御するJavaScriptが実行され、管理者アカウントの乗っ取りにつながります。理由は以下の通りです： 1. パネルはHTTP Basic認証を使用しています（ブラウザが同一オリジンリクエストに対して自動的に認証情報を送信します）。 2. change-admin-passwordエンドポイントは、ユーザーのパスワードを更新する際に現在のパスワードを必要としません。 3...

...[ More ]

Payara Server contains a vulnerability in its Server-Side Includes SSI implementation that allows arbitrary operating system command execution via the exec directive. The issue occurs because user-controlled SSI directives are passed directly to Runtime.exec without validation, sanitization, or...

Payara 7.2026.1.RC1 Arbitrary EJB Method Invocation

Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms that rely on attacker-controlled reflection, dynamic class loading, and unsafe deserialization. These endpoints allow remote clients to perform arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke EJB...

CVE-2026-12986

A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfresttoken to an attacker-controlled host that can result in a full unauthenticated takeover of Payara admin domain. A...

CVE-2026-12986

A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfresttoken to an attacker-controlled host that can result in a full unauthenticated takeover of Payara admin domain. A...

CVE-2026-12986

A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfresttoken to an attacker-controlled host that can result in a full unauthenticated takeover of Payara admin domain. A...

EUVD-2026-38793

A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfresttoken to an attacker-controlled host that can result in a full unauthenticated takeover of Payara admin domain. A...

CVE-2026-12986

Technical details are not publicly available in the provided documents. Monitor for updates.

📄 Payara Server Cross Site Scripting

Research details on exploitation for a cross site scripting vulnerability in Payara's administration REST interface. Versions below 4.1.2.191.54, 5.83.0, 6.34.0, and 7.2026.1 are affected. XSS to Admin account takeover CVE-2025-14340 A Cross-Site Scripting vulnerability in Payara’s Administration...

CVE-2025-14340

Cross-site scripting in REST Management Interface in Payara Server 4.1.2.191.54, 5.83.0, 6.34.0, 7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload...

CVE-2025-14340

Cross-site scripting in REST Management Interface in Payara Server 4.1.2.191.54, 5.83.0, 6.34.0, 7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload...

CVE-2025-14340

Payara Server stores a cross-site scripting (XSS) vulnerability in the REST Management Interface affecting versions <4.1.2.191.54, <5.83.0, <6.34.0, and

CVE-2025-14340 Admin Account Takeover via malicious URL payload

Cross-site scripting in REST Management Interface in Payara Server 4.1.2.191.54, 5.83.0, 6.34.0, 7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload...

CVE-2025-14340 Admin Account Takeover via malicious URL payload

Cross-site scripting in REST Management Interface in Payara Server 4.1.2.191.54, 5.83.0, 6.34.0, 7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload...