SQL Injection

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query is executed requiring to resetup the account.CVE-2019-5454Nextcloud · 2.0% likely

   CWE-891 bounty report

2. SQL Injection in FileContentProvider (GHSL-2021-1007)CVE-2021-43863nextcloud · CVSS 7.5 · 1.9% likely

   CWE-89

3. An SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (running on https://lookup.nextcloud.com) caused unauthenticated users to be able to execute arbitrary SQL commands.CVE-2019-5476Nextcloud · 1.8% likely

   CWE-891 bounty report

4. Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries.CVE-2019-15622Nextcloud · 0.5% likely

   CWE-891 bounty report

5. Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL ExecutionCVE-2026-45545nextcloud · CVSS 8.2 · 0.3% likely

   CWE-891 bounty report

6. Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table ViewsCVE-2026-45722nextcloud · CVSS 7.1 · 0.3% likely

   CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.