Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| No rate limiting for confirmation email lead to huge Mass mailingsAnalysed#997070 | Valid | Input Validation and Logic | Medium | 2020-11-04 | – | 82 |
| File-drop content is visible through the gallery appAnalysed#719426 | Valid | No weakness recorded | Medium | 2020-01-31 | – | 68 |
| http://www.nextcloud.com/wp-includes/js/swfupload/swfupload.swf allows open redirect / site defacementAnalysed#209520 | Valid | Open Redirect | – | 2020-03-07 | – | 42 |
| Cross site scripting - XSRF TokenAnalysed#858255 | Valid | Cross-site Scripting | Medium | 2020-06-14 | – | 32 |
| Blind Stored XSS on iOS App due to Unsanitized WebviewAnalysed#575562 | Valid | Cross-site Scripting | Low | 2020-03-07 | $100 | 28 |
| https://help.nextcloud.com::: Web cache poisoning attackAnalysed#429747 | Valid | No weakness recorded | High | 2020-01-31 | – | 25 |
| Possible denial of service when entering a loooong passwordAnalysed#840598 | Valid | Authentication | Medium | 2020-07-29 | $100 | 23 |
| "Secure View" aka "Hide Download" can be bypassed easilyAnalysed#788257 | Valid | Access Control | High | 2020-04-10 | – | 22 |
| xmlrpc.php is enabled - NextcloudAnalysed#458696 | Valid | Access Control | Medium | 2020-03-01 | – | 17 |
| Possible denial of service when entering a loooong passwordAnalysed#952349 | Valid | Authentication | Medium | 2020-09-16 | – | 16 |
| No rate limiting on sinup pageAnalysed#922470 | Valid | Input Validation and Logic | Low | 2020-09-28 | – | 16 |
| Docker image with FPM is vulnerable to CVE-2019-11043Analysed#720306 | Valid | Command and Code Injection | Critical | 2020-03-14 | $100 | 16 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.