Igniterealtime Openfire vulnerabilities

• igniterealtime openfire Openfire 4.6.0 - 'path' Stored XSS CVE-2020-36956 5.1 MediumJanuary 26, 2026
• igniterealtime openfire Openfire allows potential identity spoofing via unsafe CN parsing CVE-2025-59154 Fix available 5.9 MediumSeptember 15, 2025
• ignite realtime openfire Ignite Realtime Openfire privilege escalation vulnerability CVE-2024-25421 Fix available 9.8 CriticalMarch 26, 2024
• igniterealtime openfire Ignite Realtime Openfire privilege escalation vulnerability CVE-2024-25420 Fix available 7.2 HighMarch 26, 2024
• ignite realtime openfire Openfire administration console authentication bypass CVE-2023-32315 In KEVPublic exploitFix available EPSS 100.0% 8.6 HighMay 23, 2023
• pascom cloud phone system, igniterealtime openfire +1 more An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between... CVE-2021-45967 Fix available EPSS 20.8% 9.8 CriticalMarch 18, 2022
• igniterealtime openfire Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS. CVE-2020-35199 5.4 MediumDecember 12, 2020
• igniterealtime openfire Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS. CVE-2020-35200 6.1 MediumDecember 12, 2020
• igniterealtime openfire Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS. CVE-2020-35202 5.4 MediumDecember 12, 2020
• igniterealtime openfire Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS. CVE-2020-35201 5.4 MediumDecember 12, 2020
• igniterealtime openfire Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS. CVE-2020-35127 5.4 MediumDecember 11, 2020
• igniterealtime openfire In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute... CVE-2020-24601 6.1 MediumSeptember 2, 2020
• igniterealtime openfire A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS... CVE-2020-24604 6.1 MediumSeptember 2, 2020
• igniterealtime openfire Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an... CVE-2020-24602 6.1 MediumSeptember 2, 2020
• igniterealtime openfire Ignite Realtime Openfire allows Cross-site Scripting CVE-2019-20526 Fix available 6.1 MediumMarch 19, 2020
• igniterealtime openfire Ignite Realtime Openfire allows Cross-site Scripting CVE-2019-20525 Fix available 6.1 MediumMarch 19, 2020
• igniterealtime openfire Ignite Realtime Openfire allows Cross-site Scripting CVE-2019-20527 Fix available 6.1 MediumMarch 19, 2020
• igniterealtime openfire Ignite Realtime Openfire allows Cross-site Scripting CVE-2019-20528 Fix available 6.1 MediumMarch 18, 2020
• igniterealtime openfire XSS in Ignite Realtime Openfire via alias to Manage Store Contents CVE-2019-20363 6.1 MediumJanuary 8, 2020
• igniterealtime openfire XSS in Ignite Realtime Openfire via cacheName CVE-2019-20364 6.1 MediumJanuary 8, 2020
• igniterealtime openfire XSS in Ignite Realtime Openfire via Users/Group search page CVE-2019-20365 6.1 MediumJanuary 8, 2020
• igniterealtime openfire XSS in Ignite Realtime Openfire via isTrustStore CVE-2019-20366 Fix available 6.1 MediumJanuary 8, 2020
• igniterealtime openfire Ignite Realtime Openfire vulnerable to Server Side Request Forgery CVE-2019-18394 Public exploitFix available EPSS 32.3% 9.8 CriticalOctober 24, 2019
• igniterealtime openfire Ignite Realtime Openfire directory traversal vulnerability CVE-2019-18393 Fix available EPSS 13.9% 5.3 MediumOctober 24, 2019
• igniterealtime openfire Cross-site Scripting in Ignite Realtime Openfire CVE-2019-15488 Fix available 6.1 MediumAugust 23, 2019
• igniterealtime openfire Ignite Realtime Openfire vulnerable to cross-site scripting CVE-2018-11688 Fix available 6.1 MediumJune 13, 2018
• igniterealtime openfire Ignite Realtime Openfire Server has Cross-site Scripting vulnerability in admin console CVE-2017-15911 Fix available 4.8 MediumOctober 26, 2017
• igniterealtime openfire OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers... CVE-2014-3451 7.5 HighAugust 18, 2017
• igniterealtime openfire Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access... CVE-2015-7707 Public exploit 6.5 MediumOctober 5, 2015
• igniterealtime openfire Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2... CVE-2015-6973 Public exploit EPSS 64.8% 6.8 MediumSeptember 16, 2015
• igniterealtime openfire Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow... CVE-2015-6972 Public exploit 4.3 MediumSeptember 16, 2015
• igniterealtime openfire Ignite Realtime Openfire vulnerable to XMPPbomb attack CVE-2014-2741 Fix available 7.8 HighApril 11, 2014
• igniterealtime openfire Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka... CVE-2009-1596 6.5 MediumMay 11, 2009
• igniterealtime openfire Ignite Realtime Openfire Allows Users to Change Passwords of Arbitrary Accounts CVE-2009-1595 Public exploitFix available 4.0 MediumMay 11, 2009
• igniterealtime openfire Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers... CVE-2008-6511 Public exploit 5.8 MediumMarch 23, 2009
• igniterealtime openfire Cross-site scripting (XSS) vulnerability in login.jsp in the Admin Console in Openfire 3.6.0a and... CVE-2008-6510 Public exploit 4.3 MediumMarch 23, 2009
• igniterealtime openfire SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows... CVE-2008-6509 Public exploit 7.5 HighMarch 23, 2009
• igniterealtime openfire Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a... CVE-2008-6508 Public exploit EPSS 83.7% 7.5 HighMarch 23, 2009
• igniterealtime openfire Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows remote... CVE-2009-0497 Public exploit 5.0 MediumFebruary 10, 2009