Nextcloud · disclosed reports
Cross-site Scripting
15 disclosed reports · $1,900 paid · 15 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Nextcloud on HackerOne- reports
- 15
- valid
- 15
- paid a bounty
- 7
Every one of the 15 is a mark on the map. Named now: 1 to 15, most upvoted first.
- XSS in Desktop Client in the notifications
- Stored XSS in collabora via user name
- Stored XSS in attachment-display exploitable through SameSite
- HTML injection in search UI when selecting a circle with HTML in the display name
- Reflected XSS in error pages (NC-SA-2017-008)
- XSS in PDF Viewer
- Stored XSS on Share-popup of a directory's Gallery-view
- Persistent XSS via filename in projects
- XSS through image upload of contacts using svg file
- XSS through image upload of contacts using svg file with png extension
- Self XSS when pasting HTML into Text app with Ctrl+Shift+V
- Self XSS when sending HTML as a comment in the Deck app
- Reflected XSS when renaming a file with a vulnerable name which results in an error
- XSS in desktop client via invalid server address on login form
- DOM XSS vulnerability in search dialogue (NC-SA-2017-007)
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.