Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS.
{ "cpes": [ "cpe:2.3:a:igniterealtime:openfire:4.6.0:*:*:*:*:*:*:*" ], "severity": "Medium" }