Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Stored XSS Vulnerability via SVG FileAnalysed#3357808 | Valid | Cross-site Scripting | Medium | 2025-12-05 | $150 | 79 |
| XSS in Desktop Client in the notificationsAnalysed#1668028 | Valid | Cross-site Scripting | Low | 2022-11-25 | $750 | 50 |
| Stored XSS in collabora via user nameAnalysed#968232 | Valid | Cross-site Scripting | Low | 2020-09-19 | – | 48 |
| Stored XSS in attachment-display exploitable through SameSiteAnalysed#3594137 | Valid | Cross-site Scripting | Medium | 2026-04-19 | – | 39 |
| [Reflected XSS] In Request URLAnalysed#515484 | Valid | Cross-site Scripting | Low | 2020-03-01 | – | 37 |
| Cross site scripting - XSRF TokenAnalysed#858255 | Valid | Cross-site Scripting | Medium | 2020-06-14 | – | 32 |
| HTML injection in search UI when selecting a circle with HTML in the display nameAnalysed#2210038 | Valid | Cross-site Scripting | Low | 2023-11-21 | – | 30 |
| Blind Stored XSS on iOS App due to Unsanitized WebviewAnalysed#575562 | Valid | Cross-site Scripting | Low | 2020-03-07 | $100 | 28 |
| Reflected XSS in error pages (NC-SA-2017-008)Analysed#216812 | Valid | Cross-site Scripting | Low | 2017-05-15 | $450 | 28 |
| XSS in PDF ViewerAnalysed#819863 | Valid | Cross-site Scripting | Low | 2020-05-23 | $100 | 26 |
| Stored XSS on Share-popup of a directory's Gallery-viewAnalysed#145355 | Valid | Cross-site Scripting | – | 2016-07-19 | – | 24 |
| Persistent XSS via filename in projectsAnalysed#662204 | Valid | Cross-site Scripting | Low | 2020-03-01 | $150 | 23 |
| XSS through image upload of contacts using svg fileAnalysed#894876 | Valid | Cross-site Scripting | Low | 2020-12-17 | $100 | 22 |
| XSS through image upload of contacts using svg file with png extensionAnalysed#998422 | Valid | Cross-site Scripting | Low | 2020-12-26 | – | 21 |
| Self XSS when pasting HTML into Text app with Ctrl+Shift+VAnalysed#2211561 | Valid | Cross-site Scripting | Medium | 2023-12-21 | – | 20 |
| Self XSS when sending HTML as a comment in the Deck appAnalysed#2058556 | Valid | Cross-site Scripting | None | 2024-01-18 | – | 20 |
| [user_oidc] Stored XSS via Authorization Endpoint - Safari-OnlyAnalysed#1687410 | Valid | Cross-site Scripting | Low | 2022-12-18 | – | 19 |
| Log pollution can lead to HTML Injection.Analysed#146278 | Valid | Cross-site Scripting | – | 2016-07-19 | – | 18 |
| Reflected XSS when renaming a file with a vulnerable name which results in an errorAnalysed#896522 | Valid | Cross-site Scripting | Medium | 2021-03-01 | $100 | 17 |
| XSS in desktop client via invalid server address on login formAnalysed#685552 | Valid | Cross-site Scripting | Medium | 2020-08-17 | – | 17 |
| Reflected XSS / Markup Injection in `index.php/svg/core/logo/logo` parameter `color`Analysed#605915 | Valid | Cross-site Scripting | Medium | 2019-08-29 | – | 17 |
| DOM XSS vulnerability in search dialogue (NC-SA-2017-007)Analysed#213227 | Valid | Cross-site Scripting | Low | 2017-06-07 | $250 | 16 |
| Stored XSS in contacts app via organisation and title fieldAnalysed#3293290 | Valid | Cross-site Scripting | Low | 2026-01-04 | $100 | 15 |
| Stored XSS in OAuth redirect URIAnalysed#261138 | Valid | Cross-site Scripting | Low | 2019-05-11 | – | 14 |
| Reflected XSS vulnerability with full CSP bypass in Nextcloud installations using recommended bundleAnalysed#1893186 | Valid | Cross-site Scripting | Medium | 2023-05-15 | – | 13 |
| Stored XSS in markdown file with Nextcloud Talk using Internet ExplorerAnalysed#1023787 | Valid | Cross-site Scripting | Low | 2021-02-19 | – | 13 |
| XSS in image metadata field#896511 | Valid | Cross-site Scripting | Medium | 2020-08-05 | – | 12 |
| WordPress <= 4.6.1 Stored XSS Via Theme File#197878 | Valid | Cross-site Scripting | – | 2017-01-13 | – | 12 |
| Self xss#388527 | Valid | Cross-site Scripting | Low | 2020-04-05 | – | 11 |
| Reflected XSS in U2F plugin by shipping the example endpoints#192786 | Valid | Cross-site Scripting | High | 2017-03-22 | – | 10 |
| \OCA\DAV\CardDAV\ImageExportPlugin allows serving arbitrary data with user-defined or empty mimetype#163338 | Valid | Cross-site Scripting | Medium | 2016-12-03 | – | 9 |
| Bad content-type in response header when getting document can lead to html injection#173721 | Valid | Cross-site Scripting | Medium | 2017-01-12 | – | 7 |
| Reflected XSS in Gallery App#165686 | Valid | Cross-site Scripting | Medium | 2016-12-03 | – | 7 |
| XSS on IOS app via HTML rendering#157434 | Valid | Cross-site Scripting | Low | 2017-04-20 | – | 7 |
| ApiService#fetch serves content as text/html and inline Content-Disposition#1241460 | Valid | Cross-site Scripting | – | 2021-08-11 | – | 6 |
| HTML Injection on "polls" app - comments section (possibly XSS)#1108420 | Valid | Cross-site Scripting | Low | 2021-03-31 | – | 6 |
| Stored XSS/HTML injection in autocomplete suggestions for sharing#478957 | Valid | Cross-site Scripting | Medium | 2019-06-27 | – | 6 |
| HTML injection and limited XSS via logo image upload - Nextcloud 12.0.0#231524 | Valid | Cross-site Scripting | Low | 2020-01-31 | – | 6 |
| DOMPurify 0.8.9 released#225777 | Valid | Cross-site Scripting | Low | 2020-03-01 | – | 6 |
| HTML injection with AutoComplete suggestions#383117 | Valid | Cross-site Scripting | None | 2018-08-10 | – | 5 |
| Stored XSS on scan.nextcloud.com#390728 | Valid | Cross-site Scripting | Low | 2020-03-01 | – | 4 |
| Stored XSS on new Calling plugin (spreed)#190870 | Valid | Cross-site Scripting | High | 2016-12-13 | – | 4 |
| [Thirdparty] Stored XSS in chat module - nextcloud server 9.0.51 installed in ubuntu 14.0.4 LTS#148897 | Valid | Cross-site Scripting | Medium | 2016-11-02 | – | 4 |
| Contacts only sanitizes PHOTO svg if mime type is all lower case#1789602 | Valid | Cross-site Scripting | None | 2023-06-24 | – | 3 |
| Persistent XSS on favorite via filename#685491 | Valid | Cross-site Scripting | Medium | 2019-12-12 | – | 3 |
| Reflected Self-XSS Vulnerability in the Comment section of Files Information#164027 | Valid | Cross-site Scripting | – | 2016-08-30 | $100 | 3 |
| xss for admin of https://newsletter.nextcloud.com#153799 | Valid | Cross-site Scripting | – | 2017-02-17 | – | 3 |
| Stored XSS in Gallery application (NC-SA-2017-010)#222838 | Valid | Cross-site Scripting | Low | 2017-06-06 | – | 2 |
| Arbitrary File Upload in Logo & Log in image Theming setting.#155690 | Valid | Cross-site Scripting | – | 2016-10-05 | – | 2 |
| xss on setup config page#812028 | Valid | Cross-site Scripting | Low | 2021-02-14 | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.