Sploitus

28 exploited vulnerabilities in Openfire

Vulnerabilities with publicly known exploits

Vendors
Ignite Realtime, Openfire, Red Os, Jive
With known exploits
28
Affected Igniterealtime Openfire versions
< 4.6.8, 4.7.5, 3.6.0a, 2.6.0, 2.6.1, 2.6.2, 3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.3.0, 3.3.2, 3.3.3, 3.4.0, 3.4.1, 3.4.3, 3.4.4, 3.4.5, 3.5.0, 3.5.1, 3.5.2, 3.6.0, 3.10.2, 3.7.1, 3.6.2, 3.6.3, 3.4.2, 3.6.1

Vulnerabilities with exploits

Highest CVSS first — 11 of these already have exploit code on Sploitus

CVE-2024-25421
CVSS 9.8 CRITICAL 2024-03-26FIX AVAILABLE
CVE-2023-32315 14 exploits
CVSS 9.0 HIGH 2023-05-23FIX AVAILABLE
ghost-bits-toolkitExploit for Path Traversal in Igniterealtime Openfire
CVE-2008-6509 1 exploit
CVSS 7.5 HIGH 2009-03-23FIX AVAILABLE
Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2008-6508 5 exploits
CVSS 7.5 HIGH 2009-03-23
Openfire <= 3.6.0a Admin Console Authentication BypassOpenfire Admin Console Authentication Bypass
CVE-2024-25420
CVSS 7.2 HIGH 2024-03-26
CVE-2015-6973 2 exploits
CVSS 6.8 MEDIUM 2015-09-16
Openfire 3.10.2 - Cross-Site Request ForgeryOpenfire 3.10.2 Cross Site Request Forgery
CVE-2015-7707 2 exploits
CVSS 6.5 MEDIUM 2015-10-05FIX AVAILABLE
Openfire 3.10.2 - Privilege EscalationOpenfire 3.10.2 Privilege Escalation
CVE-2020-36956
CVSS 6.4 MEDIUM 2026-01-26
CVE-2020-35200
CVSS 6.1 MEDIUM 2020-12-12FIX AVAILABLE
CVE-2020-24604
CVSS 6.1 MEDIUM 2020-09-02FIX AVAILABLE
CVE-2020-24602
CVSS 6.1 MEDIUM 2020-09-02
CVE-2020-24601
CVSS 6.1 MEDIUM 2020-09-02
CVE-2019-20527
CVSS 6.1 MEDIUM 2020-03-19FIX AVAILABLE
CVE-2019-20526
CVSS 6.1 MEDIUM 2020-03-19FIX AVAILABLE
CVE-2019-20525
CVSS 6.1 MEDIUM 2020-03-19FIX AVAILABLE
CVE-2019-20365
CVSS 6.1 MEDIUM 2020-01-08FIX AVAILABLE
CVE-2019-20363
CVSS 6.1 MEDIUM 2020-01-08
CVE-2018-11688 1 exploit
CVSS 6.1 MEDIUM 2018-06-13FIX AVAILABLE
Ignite Realtime Openfire 3.7.1 Cross Site Scripting
CVE-2025-59154
CVSS 5.9 MEDIUM 2025-09-15FIX AVAILABLE
CVE-2008-6511 1 exploit
CVSS 5.8 MEDIUM 2009-03-23FIX AVAILABLE
Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2020-35202
CVSS 5.4 MEDIUM 2020-12-12
CVE-2020-35199
CVSS 5.4 MEDIUM 2020-12-12FIX AVAILABLE
CVE-2020-35127
CVSS 5.4 MEDIUM 2020-12-11FIX AVAILABLE
CVE-2009-0497 1 exploit
CVSS 5.0 MEDIUM 2009-02-10FIX AVAILABLE
Openfire 3.6.2 - 'log.jsp' Directory Traversal
CVE-2015-6972 2 exploits
CVSS 4.3 MEDIUM 2015-09-16FIX AVAILABLE
Openfire 3.10.2 - Multiple Cross-Site Scripting VulnerabilitiesOpenfire 3.10.2 Cross Site Scripting
CVE-2008-6510 1 exploit
CVSS 4.3 MEDIUM 2009-03-23FIX AVAILABLE
Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2009-1596
CVSS 4.0 MEDIUM 2009-05-11FIX AVAILABLE
CVE-2009-1595 1 exploit
CVSS 4.0 MEDIUM 2009-05-11FIX AVAILABLE
Openfire 3.x - jabber:iq:auth 'passwd_change' Remote Password Change