Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Remote Code Execution via Extract App PluginAnalysed#546753 | Valid | Command and Code Injection | High | 2019-05-30 | – | 124 |
| Expired reshare links allow access to all files in shareAnalysed#452854 | Valid | Access Control | Critical | 2019-06-27 | – | 38 |
| SQL Injection found in NextCloud Android App Content ProviderAnalysed#291764 | Valid | SQL Injection | Low | 2019-07-26 | $150 | 36 |
| Group admins can remove arbitrary data from "data" directory (including admin data)Analysed#508493 | Valid | Access Control | High | 2019-08-12 | – | 32 |
| Passwords being stored as plain text in loggingAnalysed#469668 | Valid | Cryptography | Low | 2019-08-31 | – | 30 |
| Gallery: No feedback for invalid passwordAnalysed#428660 | Valid | Input Validation and Logic | Low | 2019-07-27 | $50 | 22 |
| SQLi allow query restriction bypass on exposed FileContentProviderAnalysed#518669 | Valid | SQL Injection | Low | 2019-07-29 | $100 | 19 |
| Delete permission can be added on reshareAnalysed#633245 | Valid | Access Control | Low | 2019-09-03 | – | 14 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.