Payara Server - Cross-Site Scripting

Payara Server versions 4.1.2.191.54, 5.83.0, 6.34.0, and 7.2026.1 contain a stored XSS vulnerability caused by improper input sanitization in the REST Management Interface. This allows attackers to mislead administrators into changing the admin password via a URL payload; however, the exploit...

org.glassfish.main.admingui:console-commandrecorder-plugin (>=7.0.16, <=9.0.0-m3), org.glassfish.main.featuresets:debug (>=6.2.5, <=9.0.0-m3) +5 more potentially affected by CVE-2025-14340 via org.glassfish.main.admin:rest-service (>=5.0.1, <=9.0.0-m3)

org.glassfish.main.admin:rest-service MAVEN version =5.0.1, =7.0.16, =6.2.5, =7.1.0-m1, =7.1.0-m1, =5.0.1, =5.0.1, =5.0.1, =9.0.0-m3 Source cves: CVE-2025-14340 Source advisory: SNYK:JAVA-ORGGLASSFISHMAINADMIN-15323111...