Cross Site Scripting #224108 Informative No weakness recorded – 2017-04-26 – 1 Broken link for wrong domain entry may be leveraged for Phishing, Misinformation, Serving Malware #279717 Valid No weakness recorded Low 2020-03-01 – 1 Denial of Service when entring an Array in email at seetings #961997 Informative No weakness recorded Medium 2020-08-19 – 1 help.nextcloud.com: Session Management Issue #145430 Informative No weakness recorded – 2016-06-17 – 2 Server version/OS type disclosure via HTTP Response Header #215372 Informative No weakness recorded Low 2017-03-23 – 2 W3 Total Cache plugin multiple vulnerabilities #561805 Valid No weakness recorded – 2019-07-28 – 3 Default Nextcloud allows http federated shares #1183302 Informative No weakness recorded Medium 2021-05-11 – 3 Ransomware protection is missing extentions #1195568 Valid No weakness recorded Low 2021-06-16 – 3 No admin audit log for auth tokens #1200992 Informative No weakness recorded Low 2021-06-16 – 3 Nextcloud Server Remote Command Execution #226896 N/A No weakness recorded High 2017-05-10 – 4 No admin audit entry for enabling/disabling 2FA #1200989 Informative No weakness recorded Low 2021-06-16 – 4 Website PHP source code returned in javascript #1794462 Valid No weakness recorded Medium 2023-04-10 – 4 Drone Nextcloud #198773 Informative No weakness recorded – 2017-02-12 – 5 Version 4.7.2 of wordpress is vulnerable #211206 Valid No weakness recorded High 2017-03-07 – 5 Talk discloses turn server to anybody #1195593 Informative No weakness recorded Low 2021-05-26 – 5 Content spoofing due to the improper behavior of the 403 page #214340 Valid No weakness recorded – 2017-05-18 – 6 Missing SPF flags for customerupdates.nextcloud.com #385037 Valid No weakness recorded Medium 2020-03-01 – 6 Event privacy level does not work in Thunderbird #439828 Valid No weakness recorded Medium 2020-03-01 – 6 Malicious apps can crash Nextcloud Android client by sending malformed intents #859136 Valid No weakness recorded – 2021-06-17 – 6 Leaked of Profile Image from URL changing #1022211 Informative No weakness recorded – 2020-11-17 – 6 A vulnerability classified as critical has been found in gsi-openssh-server 7.9p1 on Fedora (Connectivity Software) on server (http://95.217.64.181:22 #1726445 Valid No weakness recorded Low 2022-12-10 – 6 Email Notification should be get while changing password on apps.nextcloud.com #308156 Informative No weakness recorded – 2018-02-28 – 7 Serverinfo endpoints are not bruteforce protected nor are tokens properly generated #1210458 Valid No weakness recorded Low 2021-06-16 – 7 Delete All Data of Any User #220385 Valid No weakness recorded Low 2020-03-01 – 8 user can bypass password enforcement when federated sharing is enabled #838510 Valid No weakness recorded – 2022-06-01 $250 8 PHPUnit is included in groupfolders release package potentially causing RCE #820146 Valid No weakness recorded – 2020-06-25 – 9 No rate limit while adding Additional emails feature #1913951 Valid No weakness recorded Low 2023-05-16 – 9 Group admin can remove user from all his groups via API #199286 Valid No weakness recorded None 2017-02-23 – 10 Clickjacking URLS #1039805 Valid No weakness recorded – 2021-03-10 – 10 Admin audit is not properly logging unsetting of expiration date #1200810 Valid No weakness recorded Low 2021-07-15 – 10 Wordpress Vulnerable to Potential Unauthorized Password Reset #226037 Valid No weakness recorded Low 2017-08-15 – 11 User Editable nextcloud Wiki pages of Public Repositories #498878 Valid No weakness recorded High 2019-08-31 – 11 Add to your nextcloud endpoint is not properly protected #1192144 Valid No weakness recorded Low 2021-08-11 $100 11 Wordpress 4.7.1 #201489 Valid No weakness recorded Low 2017-01-27 – 12 Design Issues on ( ███ ) Lead to show ( IPS of Users ) #218733 Valid No weakness recorded Medium 2017-04-05 – 13 Only the file extensions are checked, not the MIME types as configured #697959 Valid No weakness recorded Medium 2020-03-14 – 13 End to end encryption public key is not properly verified on Desktop and Android #1189162 Valid No weakness recorded Medium 2021-09-23 $1,500 13 Android app does not clear end to end encryption keys #1189168 Valid No weakness recorded Low 2021-06-16 $100 14 Email Spoofing Vulnerability from nextcloud. #229599 Spam No weakness recorded High 2017-05-18 – 15 Twitter Account hijack @nextcloudfrance #1916565 Valid No weakness recorded Medium 2023-03-30 – 15 public webdav endpoint not bruteforce protected #1192159 Valid No weakness recorded Low 2021-08-11 $100 17 Ransomware protection is missing extentions take 2 #1200785 Valid No weakness recorded Low 2021-07-16 $100 17 Clients do not verify server public key #1192470 Valid No weakness recorded Low 2021-09-23 $250 18 Server side request forgery (SSRF) on nextcloud implementation. #145524 Informative No weakness recorded – 2016-06-17 – 19 Deck app allows to spoof file extensions by using RTLO characters #2326618 Valid No weakness recorded Medium 2026-01-04 $100 19 Nextcloud Tables app - inserting rows to an arbitrary table possible Analysed #2671404 Valid No weakness recorded Medium 2024-11-17 – 24 https://help.nextcloud.com::: Web cache poisoning attack Analysed #429747 Valid No weakness recorded High 2020-01-31 – 25 Leak arbitrary file under nextcloud android client privacy directory Analysed #1142918 Valid No weakness recorded Medium 2021-07-17 – 25 I am because bug #226097 Spam No weakness recorded Critical 2017-05-04 – 32 tabnabbing in roundcube webmail Analysed #3367676 Valid No weakness recorded – 2025-12-24 – 37