Cross-Site Scripting (XSS)

The primefaces library is vulnerable to cross-site scripting XSS attacks through the href and target attributes of ButtonRenderer. Malicious code that is returned in the Content-Type: text/javascript context can result in that code executing within the target user's browser session...