Payara Platform vulnerabilities

Products

• Payara Server 6
• Payara Micro 1
• Payara Server, Micro and Embedded 1

Latest Payara Platform CVEs

Newest publication first

1. CVE-2025-14340 Admin Account Takeover via malicious URL payload

   Published 2026-02-18

   High·CVSS 7.3 EPSS 1.0%

   Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.

2. CVE-2025-1534 Cross-site Scripting (Stored)

   Published 2025-04-01

   Medium·CVSS 6.8 EPSS 0.31%

   CVE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Payara Platform Payara Server allows : Remote Code Inclusion.This issue affects Payara Server: from 4.1.2.1919.1 before 4.1.2.191.51, from 5.20.0 before 5.68.0, from 6.0....

3. CVE-2024-45687 HTTP Server incorrectly accepting disallowed characters within header values

   Published 2025-01-21

   Low·CVSS 2.4 EPSS 0.23%

   Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Grizzly modules) allows Manipulating State, Identity Spoofing.T...

4. CVE-2024-8215 Payload Injection Attack via Management REST interface

   Published 2024-10-08

   High·CVSS 8.7 EPSS 0.45%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Payara Platform Payara Server (Admin Console modules) allows Remote Code Inclusion.This issue affects Payara Server: from 5.20.0 before 5.68.0, from 6.0.0 before 6.19.0, f...

5. CVE-2024-8097 Sensitive information exposure when the org.glassfish.admingui LOGGER is set to FINEST level

   Published 2024-09-11

   Medium·CVSS 6.7 EPSS 0.19%

   Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Payara Platform Payara Server (Logging modules) allows Sensitive credentials posted in plain-text on the server log.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024....

6. CVE-2024-7312 REST Interface Link Redirection via Host parameter

   Published 2024-09-11

   High·CVSS 7.0 EPSS 0.22%

   URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session Hijacking.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.2020.2 before 5.2022.5...

7. CVE-2023-41699 Payara Platform: URL Redirection to untrusted site using FORM authentication

   Published 2023-11-15

   Medium·CVSS 6.1 EPSS 0.41%

   URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows Redirect Access to Libraries.This issue affects Payara Server, Micro and Embedded: from 5.0.0 before 5.57.0, from 4.1.2.1...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.