CVE-2020-36956 | Medium | 6.4 | 2026-01-26 | Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' p… |
CVE-2025-59154 | Medium | 5.9 | 2025-09-15 | Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerabi… |
CVE-2024-25421 | Critical | 9.8 | 2024-03-26 | An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component. |
CVE-2024-25420 | High | 7.2 | 2024-03-26 | An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component. |
CVE-2023-32315 | High | 8.6 | 2023-05-26 | Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerabl… |
CVE-2021-45967 | Critical | 9.8 | 2022-03-18 | An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal i… |
CVE-2020-35202 | Medium | 5.4 | 2020-12-12 | Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS. |
CVE-2020-35201 | Medium | 5.4 | 2020-12-12 | Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS. |
CVE-2020-35200 | Medium | 6.1 | 2020-12-12 | Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS. |
CVE-2020-35199 | Medium | 5.4 | 2020-12-12 | Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS. |
CVE-2020-35127 | Medium | 5.4 | 2020-12-11 | Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS. |
CVE-2020-24604 | Medium | 6.1 | 2020-09-02 | A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attackers to inject arbitrary web s… |
CVE-2020-24602 | Medium | 6.1 | 2020-09-02 | Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerabl… |
CVE-2020-24601 | Medium | 6.1 | 2020-09-02 | In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter… |
CVE-2020-12772 | High | 8.8 | 2020-05-12 | An issue was discovered in Ignite Realtime Spark 2.8.3 (and the ROAR plugin for it) on Windows. A chat message can include an IMG element with a SRC attribute… |
CVE-2019-20526 | Medium | 6.1 | 2020-03-19 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter. |
CVE-2019-20525 | Medium | 6.1 | 2020-03-19 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter. |
CVE-2019-20527 | Medium | 6.1 | 2020-03-19 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter. |
CVE-2019-20528 | Medium | 6.1 | 2020-03-18 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter. |
CVE-2019-20366 | Medium | 6.1 | 2020-01-08 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents. |
CVE-2019-20365 | Medium | 6.1 | 2020-01-08 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page. |
CVE-2019-20364 | Medium | 6.1 | 2020-01-08 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp. |
CVE-2019-20363 | Medium | 6.1 | 2020-01-08 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents. |
CVE-2019-18394 | Critical | 9.8 | 2019-10-24 | A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET… |
CVE-2019-18393 | Medium | 5.3 | 2019-10-24 | PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a director… |
CVE-2019-15488 | Medium | 6.1 | 2019-08-23 | Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test. |
CVE-2018-11688 | Medium | 6.1 | 2018-06-13 | Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could expl… |
CVE-2017-2815 | High | 8.1 | 2018-05-15 | An exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2.6.0. A specially crafted web request can cause the retrieval o… |
CVE-2017-15911 | Medium | 4.8 | 2017-10-26 | The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/s… |
CVE-2014-3451 | High | 7.5 | 2017-08-18 | OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks. |
CVE-2016-10027 | Medium | 5.9 | 2017-01-12 | Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass… |
CVE-2015-7707 | | | 2015-10-05 | Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp. |
CVE-2015-6973 | | | 2015-09-16 | Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administra… |
CVE-2015-6972 | | | 2015-09-16 | Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the (1… |
CVE-2014-5075 | | | 2014-10-25 | The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domai… |
CVE-2014-0364 | | | 2014-04-30 | The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows r… |
CVE-2014-0363 | | | 2014-04-30 | The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certifica… |
CVE-2014-2741 | | | 2014-04-11 | nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remot… |
CVE-2009-1596 | Medium | 6.5 | 2009-05-11 | Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which allows rem… |
CVE-2009-1595 | | | 2009-05-11 | The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of a… |
CVE-2008-6511 | | | 2009-03-23 | Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing a… |
CVE-2008-6510 | | | 2009-03-23 | Cross-site scripting (XSS) vulnerability in login.jsp in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to inject arbitrary web scrip… |
CVE-2008-6509 | | | 2009-03-23 | SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execute arbitrary SQL commands via the type p… |
CVE-2008-6508 | | | 2009-03-23 | Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication… |
CVE-2009-0497 | | | 2009-02-10 | Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in… |