Nextcloud · disclosed reports
Cross-site Scripting
54 disclosed reports · $2,350 paid · 51 valid · 1 informative · 1 duplicate · 1 N/A
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Nextcloud on HackerOne- reports
- 54
- valid
- 51
- paid a bounty
- 11
Every one of the 54 is a mark on the map. Named now: 27 to 52, most upvoted first.
- Stored XSS in markdown file with Nextcloud Talk using Internet Explorer
- XSS in image metadata field
- WordPress <= 4.6.1 Stored XSS Via Theme File
- Self xss
- Reflected XSS in U2F plugin by shipping the example endpoints
- \OCA\DAV\CardDAV\ImageExportPlugin allows serving arbitrary data with user-defined or empty mimetype
- Bad content-type in response header when getting document can lead to html injection
- Reflected XSS in Gallery App
- XSS on IOS app via HTML rendering
- ApiService#fetch serves content as text/html and inline Content-Disposition
- HTML Injection on "polls" app - comments section (possibly XSS)
- Stored XSS/HTML injection in autocomplete suggestions for sharing
- HTML injection and limited XSS via logo image upload - Nextcloud 12.0.0
- DOMPurify 0.8.9 released
- HTML injection with AutoComplete suggestions
- Stored XSS on scan.nextcloud.com
- Stored XSS on new Calling plugin (spreed)
- [Thirdparty] Stored XSS in chat module - nextcloud server 9.0.51 installed in ubuntu 14.0.4 LTS
- Contacts only sanitizes PHOTO svg if mime type is all lower case
- Persistent XSS on favorite via filename
- XSS On Nextcloud Integrated with zimbra drive
- Reflected Self-XSS Vulnerability in the Comment section of Files Information
- xss for admin of https://newsletter.nextcloud.com
- Stored XSS in Gallery application (NC-SA-2017-010)
- Reflected Self-XSS Vulnerability in the Comment section of Files (Different-payloads)
- Arbitrary File Upload in Logo & Log in image Theming setting.
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.