Known vulnerabilities in Openfire

Software: Openfire
Software CPE: cpe:2.3:a:ignite_realtime:openfire:*:*:*:*:*:*:*:*
Total vulnerabilities: 25
Public exploits: 4
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Openfire Openfire is affected by 25 known vulnerabilities: 2 high, 4 medium, 19 low Critical High Medium Low

Vulnerabilities (25)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU115219 - Authentication Bypass by Spoofing
CVE-2025-59154
CWE-290 Medium
No
No
5.0.2 15.09.2025 SB2025091575
#VU86983 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-1597
CWE-89 High
No
No
4.8.1 04.03.2024 SB2024030405
SB2024030406
SB2024030427
and 47 more
#VU76466 - Improper Authentication
CVE-2023-32315
CWE-287 High
Available
Exploited
4.6.8, 4.7.5 24.05.2023 SB2023052418
#VU49009 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-35202
CWE-79 Low
No
No
4.6.1 12.12.2020 SB2020121530
#VU49010 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-35201
CWE-79 Low
No
No
4.6.1 12.12.2020 SB2020121530
#VU49011 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-35200
CWE-79 Low
No
No
4.6.1 12.12.2020 SB2020121530
#VU49012 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-35199
CWE-79 Low
No
No
4.6.1 12.12.2020 SB2020121530
#VU49008 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-35127
CWE-79 Low
No
No
4.6.1 11.12.2020 SB2020121530
#VU34723 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-20525
CWE-79 Low
No
No
4.4.2 19.03.2020 SB2020031834
#VU34724 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-20526
CWE-79 Low
No
No
4.4.2 19.03.2020 SB2020031834
#VU34725 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-20527
CWE-79 Low
No
No
4.4.2 19.03.2020 SB2020031834
#VU34729 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-20528
CWE-79 Low
No
No
4.4.2 18.03.2020 SB2020031834
#VU34890 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-20363
CWE-79 Low
No
No
4.5.0 08.01.2020 SB2020010823
#VU34891 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-20364
CWE-79 Low
No
No
4.5.0 08.01.2020 SB2020010823
#VU34892 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-20365
CWE-79 Low
No
No
4.5.0 08.01.2020 SB2020010823
#VU34893 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-20366
CWE-79 Low
No
No
4.5.0 08.01.2020 SB2020010823
#VU21736 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2017-15911
CWE-79 Low
No
No
4.2.0 12.10.2019 SB2017102613
SB2025081409
#VU21735 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-11688
CWE-79 Low
No
No
3.9.2 12.10.2019 SB2018061312
#VU21734 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
4.4.2 12.10.2019 SB2019101201
#VU20417 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-15488
CWE-79 Low
No
No
4.4.1 27.08.2019 SB2019082313


Showing elements 1 - 20 out of 25