Skip to content
OpenAdvisories

Product · igniterealtime

Openfire

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.4
    CVE-2020-36956

    Openfire 4.6.0 - 'path' Stored XSS

    Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' parameter. Attackers can craft a payload with script tags to execute arbitrary JavaScript in the cont…

    igniterealtime Openfire
  • Medium 5.9
    CVE-2025-59154

    Openfire allows potential identity spoofing via unsafe CN parsing

    Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured A…

    igniterealtime Openfire org.igniterealtime.openfire:xmppserver Maven