Eclipse Glassfish

A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement.

Published: 2026-05-19T14:03:18.650Z
Updated: 2026-05-20T10:26:19.337Z

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user.

Published: 2026-05-19T14:12:06.459Z
Updated: 2026-05-20T10:24:59.460Z

In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints.

Published: 2025-07-16T11:15:03.412Z
Updated: 2025-07-16T15:53:13.391Z

In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.

Published: 2025-07-16T10:47:55.853Z
Updated: 2025-07-16T14:39:10.179Z

In Eclipse GlassFish version 7.0.16 or earlier it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts.

Published: 2025-07-16T10:14:28.966Z
Updated: 2025-07-16T14:39:49.251Z

In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed. This vulnerability is caused by the vulnerability (CVE-2023-41080) in the Apache code included in GlassFish. This vulnerability only affects applications that are explicitly deployed to the root context ('/').

Published: 2024-09-11T13:26:47.468Z
Updated: 2024-09-11T13:40:06.290Z

In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.

Published: 2025-07-16T11:07:55.848Z
Updated: 2025-07-16T14:38:55.074Z

In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating system.

Published: 2025-07-16T11:02:51.419Z
Updated: 2025-07-16T14:38:59.823Z

In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console.

Published: 2025-07-16T10:55:35.408Z
Updated: 2025-07-16T14:39:05.571Z