CVE-2025-14340

published 2026-02-18

CVE-2025-14340: Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator…

Priority P3 46 high 7.3 CVSS 4.0

AV N AC L AT N PR H UI A VC H VI H VA H SC H SI H SA H E U CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S P AU N R U V X RE M U Red

EXPLOIT

Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
payara_platform	payara_server	4.1.153.1 – 4.1.2.191.53	—
payara_platform	payara_server	5.181 – 5.201.2	—
payara_platform	payara_server	5.20.0 – 5.82.0	—
payara_platform	payara_server	5.2020.2 – 5.2022.5	—
payara_platform	payara_server	6.0.0 – 6.33.0	—
payara_platform	payara_server	6.2022.1 – 6.2025.11	—
payara_platform	payara_server	7.2024.1.Alpha1 – 7.2025.2	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79