OP
Product
Openfire
On CISA KEVExploited in the wild
39
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 3Medium 23Low 0
Watch
Add Openfire to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2009-1596 | 6.5 | May 11 | Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which allows remote authenticated… Affected: before 3.6.5 |
| CVE-2020-36956 | 6.4 | Jan 26 | Openfire 4.6.0 - 'path' Stored XSS Affected: through 4.6.0 |
| CVE-2020-35200 | 6.1 | Dec 12 | Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS Affected: 4.6.0 |
| CVE-2020-24604 | 6.1 | Sep 2 | A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1 Affected: 4.5.1 |
| CVE-2020-24602 | 6.1 | Sep 2 | Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter… Affected: 4.5.1 |
| CVE-2020-24601 | 6.1 | Sep 2 | In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter searchName", "alias"… Affected: 4.5.1 |
| CVE-2019-20526 | 6.1 | Mar 19 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter Affected: 4.4.1 |
| CVE-2019-20525 | 6.1 | Mar 19 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter Affected: 4.4.1 |
| CVE-2019-20527 | 6.1 | Mar 19 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter Affected: 4.4.1 |
| CVE-2019-20528 | 6.1 | Mar 18 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter Affected: 4.4.1 |
| CVE-2019-20366 | 6.1 | Jan 8 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents Affected: 4.4.4 |
| CVE-2019-20365 | 6.1 | Jan 8 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page Affected: 4.4.4 |
| CVE-2019-20364 | 6.1 | Jan 8 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp Affected: 4.4.4 |
| CVE-2019-20363 | 6.1 | Jan 8 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents Affected: 4.4.4 |
| CVE-2019-15488 | 6.1 | Aug 23 | Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test Affected: before 4.4.1 |
| CVE-2018-11688 | 6.1 | Jun 13 | Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input Affected: 3.7.1 |
| CVE-2025-59154 | 5.9 | Sep 15 | Openfire allows potential identity spoofing via unsafe CN parsing Affected: < 5.0.2 |
| CVE-2020-35202 | 5.4 | Dec 12 | Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS Affected: 4.6.0 |
| CVE-2020-35201 | 5.4 | Dec 12 | Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS Affected: 4.6.0 |
| CVE-2020-35199 | 5.4 | Dec 12 | Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS Affected: 4.6.0 |
| CVE-2020-35127 | 5.4 | Dec 11 | Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS Affected: 4.6.0 |
| CVE-2019-18393 | 5.3 | Oct 24 | PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal… Affected: through 4.4.2 |
| CVE-2017-15911 | 4.8 | Oct 26 | The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted… Affected: through 4.1.6 |
Showing 23