Nextcloud · disclosed reports
Cross-site Scripting
51 disclosed reports · $2,350 paid · 51 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Nextcloud on HackerOne- reports
- 51
- valid
- 51
- paid a bounty
- 11
Every one of the 51 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Stored XSS Vulnerability via SVG File
- XSS in Desktop Client in the notifications
- Stored XSS in collabora via user name
- Stored XSS in attachment-display exploitable through SameSite
- [Reflected XSS] In Request URL
- Cross site scripting - XSRF Token
- HTML injection in search UI when selecting a circle with HTML in the display name
- Blind Stored XSS on iOS App due to Unsanitized Webview
- Reflected XSS in error pages (NC-SA-2017-008)
- XSS in PDF Viewer
- Stored XSS on Share-popup of a directory's Gallery-view
- Persistent XSS via filename in projects
- XSS through image upload of contacts using svg file
- XSS through image upload of contacts using svg file with png extension
- Self XSS when pasting HTML into Text app with Ctrl+Shift+V
- Self XSS when sending HTML as a comment in the Deck app
- [user_oidc] Stored XSS via Authorization Endpoint - Safari-Only
- Log pollution can lead to HTML Injection.
- Reflected XSS when renaming a file with a vulnerable name which results in an error
- XSS in desktop client via invalid server address on login form
- Reflected XSS / Markup Injection in `index.php/svg/core/logo/logo` parameter `color`
- DOM XSS vulnerability in search dialogue (NC-SA-2017-007)
- Stored XSS in contacts app via organisation and title field
- Stored XSS in OAuth redirect URI
- Reflected XSS vulnerability with full CSP bypass in Nextcloud installations using recommended bundle
- Stored XSS in markdown file with Nextcloud Talk using Internet Explorer
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.