CVE-2019-20528: Ignite Realtime Openfire

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.

Affected products

• Ignite Realtime Openfire: version 4.4.1 only

Published 2020-03-18. Last modified 2026-06-17.