Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

13 records

Vendor: Payara Platform Clear all filters
TI-2026-11048 CVE-2026-12986 · GHSA-x939-7fq5-v9v6

Cross-site request forgery in Payara Server

Priority LOW 34

A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfresttoken to an attacker-controlled host that can…

CVSS 4.0HIGH 7.3 Adjacent network No auth User interaction EPSS 0.00274 Published 2026-06-24 Fixed in 7.2026.6, 7.1.0 +3 CWE-352
TI-2025-13101 CVE-2025-14340 · GHSA-rgjw-pqcr-56gf

Admin Account Takeover via malicious URL payload

Priority LOW 36

Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.

CVSS 4.0HIGH 7.3 Network High privileges User interaction EPSS 0.0103 Published 2026-02-18 Fixed in 4.1.2.191.54, 5.83.0 +2 CWE-79
TI-2025-01321 CVE-2025-1534 · GHSA-2cp9-r2rg-qvgg

Cross-site scripting (Stored) in Payara Server

Priority LOW 30

CVE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Payara Platform Payara Server allows : Remote Code Inclusion.This issue affects Payara Server: from 4.1.2.1919…

CVSS 4.0MEDIUM 6.8 Network High privileges User interaction EPSS 0.00306 Published 2025-04-01 Fixed in 4.1.2.191.51, 5.68.0 +2 CWE-79
TI-2024-30678 CVE-2024-45687 · GHSA-mqh5-c2wx-v3pq

HTTP Server incorrectly accepting disallowed characters within header values

Priority LOW 12

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Gri…

CVSS 4.0LOW 2.4 Local Low privileges User interaction EPSS 0.00232 Published 2025-01-21 No fix listed CWE-113
TI-2024-07614 CVE-2024-8215 · GHSA-833w-v8hc-4v7f

Payload Injection Attack via Management REST interface

Priority MEDIUM 40

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Payara Platform Payara Server (Admin Console modules) allows Remote Code Inclusion.This issue affects Payara Se…

CVSS 4.0HIGH 8.7 Network High privileges User interaction EPSS 0.00451 Published 2024-10-08 Fixed in 5.68.0, 6.19.0 +2 CWE-79
TI-2024-07509 CVE-2024-8097 · GHSA-w9q2-g4fg-c4pw

Sensitive information exposure when the org.glassfish.admingui LOGGER is set to FINEST level

Priority LOW 29

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Payara Platform Payara Server (Logging modules) allows Sensitive credentials posted in plain-text on the server log.This issue affects Payara Se…

CVSS 4.0MEDIUM 6.7 Local High privileges User interaction EPSS 0.00188 Published 2024-09-11 Fixed in 6.18.0, 6.2024.9 +3 CWE-200
TI-2024-06773 CVE-2024-7312 · GHSA-jfgw-v3p5-42qh

REST Interface Link Redirection via Host parameter

Priority LOW 32

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session Hijacking.This issue affects Payara Server: from 6.0.0 before 6.18.0,…

CVSS 4.0HIGH 7.0 Local High privileges User interaction EPSS 0.00217 Published 2024-09-11 Fixed in 6.18.0, 6.2024.9 +3 CWE-601
TI-2023-22121 CVE-2023-41699 · GHSA-q42q-53wf-q55x

Payara Platform: URL Redirection to untrusted site using FORM authentication

Priority LOW 27

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows Redirect Access to Libraries.This issue affects Payara Server…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00407 Published 2023-11-15 Partial fix · 5.57.0, 4.1.2.191.46 +2 CWE-601
TI-2023-13003 CVE-2023-28462 · GHSA-xc93-587g-mxm7

A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191…

Priority MEDIUM 51

A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community), when Java 1.8u181 and earlier is used, allows remote attacke…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00938 Published 2023-03-30 Fixed in 6.2022.1.Alpha3 CWE-502