CVE-2020-36956 — Openfire 4.6.0 - 'path' Stored XSS
Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' parameter. Attacker…
Published: 2026-01-26 · CVSS: 5.1 · CVSS 4.0
Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' parameter. Attackers can craft a payload with script tags to execute arbitrary JavaScript in the context of administrative users viewing the nodejs configuration page.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7