Skip to content

Product

eclipse mojarra vulnerabilities

4 published CVES affecting eclipse mojarra, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
0
High
2
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest eclipse mojarra CVEs

Newest publication first

  1. CVE-2026-46581 wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include

    Published
    HighCVSS 7.5 EPSS 0.56%

    In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileg...

  3. CVE-2019-17091 Cross-site Scripting in Eclipse Mojarra

    Published
    MediumCVSS 6.1 EPSS 2.5%

    faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.

  4. CVE-2018-14371 Path Traversal in Eclipse Mojarra

    Published
    HighCVSS 7.5 EPSS 4.4%

    The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.