No password confirmation required when using apptoken on sensitive endpoint #3566607 Valid Access Control Medium 2026-10-27 – 2 Content Spoofing #145374 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 No permission set on Activities [Android App] #145402 Informative Authentication – 2016-06-20 – 3 No rate limiting on password protected shared file link #145462 Duplicate Authentication – 2016-06-20 – 3 failure to invalidate session on password change #145488 Informative Authentication – 2017-04-20 – 3 https://newsletter.nextcloud.com Directory listening and Information Disclosure #145603 Valid Information Disclosure – 2016-06-18 – 3 No captcha on newsletter.nextcloudcom leaves vulnerable to email spammers #145612 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 Bruteforce attack is possible on newsletter.nextcloud.com #145722 Informative Authentication – 2016-06-19 – 3 Content Spoofing/Text Injection - docs.nextcloud.org #145850 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 Content injection in subdomain #145853 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 The application uses basic authentication. #151847 Informative Authentication – 2016-07-18 – 3 xss for admin of https://newsletter.nextcloud.com #153799 Valid Cross-site Scripting – 2017-02-17 – 3 demo.nextcloud.com: Content spoofing due to default Apache Error Page #155189 Valid Misconfiguration and Insecure Design – 2016-09-29 – 3 Reflected Self-XSS Vulnerability in the Comment section of Files Information #164027 Valid Cross-site Scripting – 2016-08-30 $100 3 **minor issue ** -Nextcloud 10.0 session issue with desktop client and android client #165353 Valid Misconfiguration and Insecure Design – 2020-03-01 – 3 Login Hints on Admin Panel #188195 Informative Misconfiguration and Insecure Design – 2016-12-05 – 3 Content (Text) Injection at https://nextcloud.com #222805 Informative Misconfiguration and Insecure Design – 2017-05-15 – 3 ci.nextcloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service) #237860 Valid Denial of Service – 2017-06-08 – 3 Bruteforce in admin panel #341074 Valid Authentication – 2020-01-31 – 3 Missing X-Content-Type-Options #369979 Valid Misconfiguration and Insecure Design – 2020-03-01 – 3 Retrieval and alteration of exposed media on Android Oreo #462441 Informative Information Disclosure – 2019-06-26 – 3 Github repo's wiki publicly editable #475114 Valid Access Control – 2020-01-31 – 3 Password authentication at newsletter.nextcloud.com discloses username list #476439 Valid Information Disclosure – 2020-03-01 – 3 XSS On Nextcloud Integrated with zimbra drive #498852 Informative Cross-site Scripting – 2019-11-11 – 3 W3 Total Cache plugin multiple vulnerabilities #561805 Valid No weakness recorded – 2019-07-28 – 3 Veracode and security audit record are publicly available #669365 Informative Information Disclosure – 2019-09-10 – 3 Persistent XSS on favorite via filename #685491 Valid Cross-site Scripting – 2019-12-12 – 3 Improper confidentiality protection of server-side encryption keys #743505 Valid Authentication – 2020-11-13 – 3 Bypassing Passcode/Device credentials #747726 Valid Access Control – 2021-01-15 – 3 External storage app saves password for all users in the database #867164 Valid Authentication High 2021-03-01 – 3 New users can read all Nextcloud Deck data from previous user with same username #882258 Valid Insecure Direct Object Reference Low 2021-02-14 – 3 Contacts menu (not app) fails to restrict (to local groups) for contacts from federated servers #895730 Valid Information Disclosure Low 2020-07-25 – 3 Federated shares are not password protected #1167817 Informative Authentication Medium 2021-06-16 – 3 Nextcloud update checks leaks information #1173411 Informative Information Disclosure None 2021-05-01 – 3 Default Nextcloud allows http federated shares #1183302 Informative No weakness recorded Medium 2021-05-11 – 3 Ransomware protection is missing extentions #1195568 Valid No weakness recorded Low 2021-06-16 – 3 No admin audit log for auth tokens #1200992 Informative No weakness recorded Low 2021-06-16 – 3 Information Exposure Through Directory Listing vulnerability #1476709 Informative Information Disclosure Medium 2022-02-11 – 3 Contacts only sanitizes PHOTO svg if mime type is all lower case #1789602 Valid Cross-site Scripting None 2023-06-24 – 3 Unauthenticated Persistent Denial-of-Service via Federated Share Injection #3679640 Valid Denial of Service High 2026-10-27 – 3 stats.nextcloud.com: Content Injection #145375 Valid Misconfiguration and Insecure Design – 2016-07-17 – 4 Enumeration of subscribed users and unauthenticated email unsubscriptions on https://newsletter.nextcloud.com/?p=unsubscribe #145396 Valid Information Disclosure – 2016-06-19 – 4 help.nextcloud.com: Known DoS condition (null pointer deref) in Nginx running #145409 Valid Denial of Service – 2016-07-27 – 4 nextcloud.com: Mail Bombing ( No Rate Limiting On Sending Emails On Contact us Page) #145458 Valid Memory Corruption – 2016-07-17 – 4 nextcloud.com: Directory listening for 'wp-includes' forders #145495 Valid Information Disclosure – 2016-06-17 – 4 newsletter.nextcloud.com: Bypass firewall protection #145730 Valid Authentication – 2016-07-18 – 4 WordPress Vulnerabilities: User Enumeration, Vulnerable Akismet Plugin, XML-RPC Interface available #146093 Informative Information Disclosure – 2016-06-22 – 4 REG: Content provider information leakage #146179 Informative Command and Code Injection – 2016-06-24 – 4 [Thirdparty] Stored XSS in chat module - nextcloud server 9.0.51 installed in ubuntu 14.0.4 LTS #148897 Valid Cross-site Scripting – 2016-11-02 – 4 Information disclosure #152499 N/A Information Disclosure – 2017-04-20 – 4