Skip to content

Vendor

org.primefaces vulnerabilities

2 published CVES affecting org.primefaces, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
1
High
0
Medium
1
Low
0
Unscored
0
CISA KEV
1
Atom feed of org.primefaces alerts

Products

Latest org.primefaces CVEs

Newest publication first

  1. CVE-2020-10544 Cross-site Scripting in PrimeFaces

    Published
    MediumCVSS 6.1 EPSS 0.83%

    An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation.

  2. CVE-2017-1000486 Inadequate Encryption Strength

    Published
    CriticalCVSS 9.8 EPSS 94.1% CISA KEV added 2022-01-10 Exploited in the wild Framework module Public exploit PoC

    Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.