Description
Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Payara Platform | Payara Server | 4.1.153.1 – ≤ 4.1.2.191.53, 5.20.0 – ≤ 5.82.0, 6.0.0 – ≤ 6.33.0, 7.2024.1.Alpha1 – ≤ 7.2025.2, 6.2022.1 – ≤ 6.2025.11, 5.2020.2 – ≤ 5.2022.5, 5.181 – ≤ 5.201.2 | 4.1.2.191.54 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
DeepSecurityResearch/CVE-2025-14340 ★ 1 · Mar 23, 2026
PoC for CVE-2025-14340: Admin account takeover in Payara Server
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Payara Server - Cross-Site Scripting http/cves/2025/CVE-2025-14340.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.