Stored XSS Vulnerability via SVG File Analysed #3357808 Valid Cross-site Scripting Medium 2025-12-05 $150 79 XSS in Desktop Client in the notifications #1668028 Valid Cross-site Scripting Low 2022-11-25 $750 50 Stored XSS in collabora via user name #968232 Valid Cross-site Scripting Low 2020-09-19 – 48 Stored XSS in attachment-display exploitable through SameSite #3594137 Valid Cross-site Scripting Medium 2026-04-19 – 39 [Reflected XSS] In Request URL #515484 Valid Cross-site Scripting Low 2020-03-01 – 37 Cross site scripting - XSRF Token #858255 Valid Cross-site Scripting Medium 2020-06-14 – 32 HTML injection in search UI when selecting a circle with HTML in the display name #2210038 Valid Cross-site Scripting Low 2023-11-21 – 30 Blind Stored XSS on iOS App due to Unsanitized Webview #575562 Valid Cross-site Scripting Low 2020-03-07 $100 28 Reflected XSS in error pages (NC-SA-2017-008) #216812 Valid Cross-site Scripting Low 2017-05-15 $450 28 XSS in PDF Viewer #819863 Valid Cross-site Scripting Low 2020-05-23 $100 26 Stored XSS on Share-popup of a directory's Gallery-view #145355 Valid Cross-site Scripting – 2016-07-19 – 24 Persistent XSS via filename in projects #662204 Valid Cross-site Scripting Low 2020-03-01 $150 23 XSS through image upload of contacts using svg file #894876 Valid Cross-site Scripting Low 2020-12-17 $100 22 XSS through image upload of contacts using svg file with png extension #998422 Valid Cross-site Scripting Low 2020-12-26 – 21 Self XSS when pasting HTML into Text app with Ctrl+Shift+V #2211561 Valid Cross-site Scripting Medium 2023-12-21 – 20 Self XSS when sending HTML as a comment in the Deck app #2058556 Valid Cross-site Scripting None 2024-01-18 – 20 [user_oidc] Stored XSS via Authorization Endpoint - Safari-Only #1687410 Valid Cross-site Scripting Low 2022-12-18 – 19 Log pollution can lead to HTML Injection. #146278 Valid Cross-site Scripting – 2016-07-19 – 18 Reflected XSS when renaming a file with a vulnerable name which results in an error #896522 Valid Cross-site Scripting Medium 2021-03-01 $100 17 XSS in desktop client via invalid server address on login form #685552 Valid Cross-site Scripting Medium 2020-08-17 – 17 Reflected XSS / Markup Injection in `index.php/svg/core/logo/logo` parameter `color` #605915 Valid Cross-site Scripting Medium 2019-08-29 – 17 DOM XSS vulnerability in search dialogue (NC-SA-2017-007) #213227 Valid Cross-site Scripting Low 2017-06-07 $250 16 Stored XSS in contacts app via organisation and title field #3293290 Valid Cross-site Scripting Low 2026-01-04 $100 15 Stored XSS in OAuth redirect URI #261138 Valid Cross-site Scripting Low 2019-05-11 – 14 Unauthenticated Stored xss #168054 N/A Cross-site Scripting – 2016-09-13 – 14 Reflected XSS vulnerability with full CSP bypass in Nextcloud installations using recommended bundle #1893186 Valid Cross-site Scripting Medium 2023-05-15 – 13 Stored XSS in markdown file with Nextcloud Talk using Internet Explorer #1023787 Valid Cross-site Scripting Low 2021-02-19 – 13 XSS in image metadata field #896511 Valid Cross-site Scripting Medium 2020-08-05 – 12 WordPress <= 4.6.1 Stored XSS Via Theme File #197878 Valid Cross-site Scripting – 2017-01-13 – 12 Self xss #388527 Valid Cross-site Scripting Low 2020-04-05 – 11 Reflected XSS in U2F plugin by shipping the example endpoints #192786 Valid Cross-site Scripting High 2017-03-22 – 10 \OCA\DAV\CardDAV\ImageExportPlugin allows serving arbitrary data with user-defined or empty mimetype #163338 Valid Cross-site Scripting – 2016-12-03 – 9 Bad content-type in response header when getting document can lead to html injection #173721 Valid Cross-site Scripting – 2017-01-12 – 7 Reflected XSS in Gallery App #165686 Valid Cross-site Scripting – 2016-12-03 – 7 XSS on IOS app via HTML rendering #157434 Valid Cross-site Scripting – 2017-04-20 – 7 ApiService#fetch serves content as text/html and inline Content-Disposition #1241460 Valid Cross-site Scripting – 2021-08-11 – 6 HTML Injection on "polls" app - comments section (possibly XSS) #1108420 Valid Cross-site Scripting Low 2021-03-31 – 6 Stored XSS/HTML injection in autocomplete suggestions for sharing #478957 Valid Cross-site Scripting Medium 2019-06-27 – 6 HTML injection and limited XSS via logo image upload - Nextcloud 12.0.0 #231524 Valid Cross-site Scripting Low 2020-01-31 – 6 DOMPurify 0.8.9 released #225777 Valid Cross-site Scripting Low 2020-03-01 – 6 HTML injection with AutoComplete suggestions #383117 Valid Cross-site Scripting None 2018-08-10 – 5 Stored XSS on scan.nextcloud.com #390728 Valid Cross-site Scripting Low 2020-03-01 – 4 Stored XSS on new Calling plugin (spreed) #190870 Valid Cross-site Scripting High 2016-12-13 – 4 [Thirdparty] Stored XSS in chat module - nextcloud server 9.0.51 installed in ubuntu 14.0.4 LTS #148897 Valid Cross-site Scripting – 2016-11-02 – 4 Contacts only sanitizes PHOTO svg if mime type is all lower case #1789602 Valid Cross-site Scripting None 2023-06-24 – 3 Persistent XSS on favorite via filename #685491 Valid Cross-site Scripting Medium 2019-12-12 – 3 XSS On Nextcloud Integrated with zimbra drive #498852 Informative Cross-site Scripting Medium 2019-11-11 – 3 Reflected Self-XSS Vulnerability in the Comment section of Files Information #164027 Valid Cross-site Scripting – 2016-08-30 $100 3 xss for admin of https://newsletter.nextcloud.com #153799 Valid Cross-site Scripting – 2017-02-17 – 3 Stored XSS in Gallery application (NC-SA-2017-010) #222838 Valid Cross-site Scripting Low 2017-06-06 – 2