Disclosure of administrators via JSON on nextcloud.com Wordpress #198012 Valid Information Disclosure – 2017-01-13 – 12 WordPress <= 4.6.1 Stored XSS Via Theme File #197878 Valid Cross-site Scripting – 2017-01-13 – 12 No Rate Limiting on stats.nextcloud.com login #146424 Informative Misconfiguration and Insecure Design – 2016-06-22 – 12 Code injection allows unprivileged local attacker to execute arbitrary code in Nextcloud's OAuth/web renderer process #3772818 Valid Command and Code Injection Low 2026-10-24 – 11 Unauthorised access with hidden public link creation when sharing to a Team External Member #3625932 Valid Access Control Low 2026-10-27 $100 11 New AppPassword can be generated without password confirmation #2067572 Valid Access Control High 2023-08-10 $250 11 Mail app - blind SSRF via smtpHost parameter #1746582 Valid Server-Side Request Forgery Low 2023-02-06 – 11 Hide download previews are accessible without a watermark #1745755 Valid Access Control Low 2023-05-04 – 11 Mail app - Blind SSRF via Sierve server fonctionnality and sieveHost parameter #1741525 Valid Server-Side Request Forgery Low 2023-02-06 – 11 [nextcloud/server] Moment.js vulnerable to Inefficient Regular Expression Complexity #1712329 Valid Authentication – 2022-12-09 – 11 com.nextcloud.client bypass the protection lock in andoid app v 3.18.1 latest version. #1450368 Valid Access Control Low 2022-04-30 $200 11 Add to your nextcloud endpoint is not properly protected #1192144 Valid No weakness recorded Low 2021-08-11 $100 11 Default settings leak federated cloud id to lookup server of all users #1173436 Valid Information Disclosure Low 2021-06-10 $350 11 Update App Store: Django account high jacking vulnerability #761329 Valid Access Control Medium 2020-01-31 – 11 In Dockerized Environments, Failing to Read config.php Grants Any Anonymous User Full Admin Access #522876 Valid Access Control High 2019-07-27 – 11 User Editable nextcloud Wiki pages of Public Repositories #498878 Valid No weakness recorded High 2019-08-31 – 11 WordPress vulnerable to multiple attacks at https://nextcloud.com #476526 Valid Misconfiguration and Insecure Design Medium 2020-03-01 – 11 Server-Side request forgery in New-Subscription feature of the calendar app #427835 Valid Server-Side Request Forgery Medium 2019-12-12 $100 11 Self xss #388527 Valid Cross-site Scripting Low 2020-04-05 – 11 The session token in the URL #341372 Informative Information Disclosure Medium 2018-06-19 – 11 Wordpress Vulnerable to Potential Unauthorized Password Reset #226037 Valid No weakness recorded – 2017-08-15 – 11 Invalid request may lead content spoofing for phishing #213056 Valid Misconfiguration and Insecure Design – 2017-04-12 – 11 Content spoofing in lookup.nextcloud.com #171497 Valid Misconfiguration and Insecure Design – 2016-10-10 – 11 Document content of files can be obtained through Collabora for files of other users #1788222 Valid Access Control Medium 2023-05-04 – 10 Potential directory traversal in OC\Files\Node\Folder::getFullPath #1765631 Valid File and Path Handling Medium 2023-05-04 – 10 nextcloudcmd incorrectly trusts bad TLS certificates #1699740 Valid Cryptography Low 2022-12-25 – 10 Last video frame is still sent after video is disabled in a call #1641088 Valid Information Disclosure Medium 2022-09-16 – 10 Possibility to force an admin to install recommended applications #1403614 Valid Cross-Site Request Forgery Low 2022-04-29 $100 10 SQL injextion via vulnerable doctrine/dbal version #1390331 Valid SQL Injection High 2022-05-11 – 10 RCE on 17 different Docker containers on your network #1332433 Valid Command and Code Injection Critical 2021-10-20 – 10 High memory usage for generating preview of broken image #1261225 Valid Memory Corruption Low 2022-03-09 – 10 Download of file with arbitrary extension via injection into attachment header #1215263 Valid Command and Code Injection Medium 2021-08-11 $125 10 Admin audit is not properly logging unsetting of expiration date #1200810 Valid No weakness recorded Low 2021-07-15 – 10 End to end encryption folder locking is not properly protected #1189174 Valid Access Control Low 2021-06-10 $250 10 index.php/apps/files_sharing/shareinfo endpoint is not properly protected #1173684 Valid Denial of Service Medium 2021-08-11 $100 10 Improper input-size validation on the user new session name can result in server-side DDoS. #1153138 Valid Denial of Service Medium 2022-05-31 – 10 Clickjacking URLS #1039805 Valid No weakness recorded – 2021-03-10 – 10 The password recovery let users know whether an email address exists or not in the website #681468 Valid Authentication – 2019-11-22 – 10 twofactor_auth bypassable if provider fails to load #317711 Valid Authentication Low 2018-09-27 – 10 [FG-VD-17-063] NextCloud Insufficient Attack Protection Vulnerability Notification #232347 Valid Command and Code Injection – 2018-07-29 $100 10 GIT Detected #221298 Valid Information Disclosure – 2017-04-20 – 10 Group admin can remove user from all his groups via API #199286 Valid No weakness recorded – 2017-02-23 – 10 bug reporting template encourages users to paste config file with passwords #196878 Valid Information Disclosure – 2017-04-19 – 10 Reflected XSS in U2F plugin by shipping the example endpoints #192786 Valid Cross-site Scripting – 2017-03-22 – 10 Uploading files to a folder where invited user don't have any EDIT privilege #145950 Valid Authentication – 2016-07-19 – 10 Bruteforcing help.nextcloud.com #145727 Informative Authentication – 2016-06-19 – 10 Public collectives allow to create pages #3533697 Valid Access Control Low 2026-09-17 – 9 Unauthorized users can enumerate internal team resources via the Teams API when a team is visible to everyone #3511955 Valid Access Control Medium 2026-10-27 – 9 No rate limit while adding Additional emails feature #1913951 Valid No weakness recorded Low 2023-05-16 – 9 Vulnerable moment-timezone version shipped #1708873 Valid Cryptography – 2023-02-08 – 9