Skip to content
Noroxi

nextcloud records

372 published records for vendor nextcloud.

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 0.3%
Pre-auth RCE
3
With a fix record
22.3%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

372 records
  • CVE-2022-24838
    49Plan

    Command Injection in Appointment Emails for Nextcloud Calendar

    CriticalCVSS 9.8No exploitEPSS 33%

    nextcloud · calendarApr 11, 2022

  • CVE-2021-32802
    40Plan

    Preview generation used third-party library not suited for user-generated content in Nextcloud server

    CriticalCVSS 9.8No exploitEPSS 3%

    nextcloud · nextcloud serverSep 7, 2021

  • CVE-2024-30247
    40Plan

    Command Injection as root in NextCloudPi web panel

    CriticalCVSS 9.8No exploitEPSS 2%

    nextcloud · nextcloudpiMar 29, 2024

  • CVE-2019-5454
    40Plan

    SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query is executed requiring

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    nextcloud · nextcloudJul 30, 2019

  • CVE-2019-5476
    40Plan

    An SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (running on https://lookup.nextcloud.com) caused unauthenticated users to be able t

    CriticalCVSS 9.8No exploitEPSS 2%

    nextcloud · lookup-serverAug 7, 2019

  • CVE-2021-32726
    40Plan

    Webauthn tokens not removed after user has been deleted

    CriticalCVSS 9.8No exploitEPSS 2%

    nextcloud · nextcloud serverJul 12, 2021

  • CVE-2021-22915
    40Plan

    Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limit

    CriticalCVSS 9.8No exploitEPSS 2%

    nextcloud · nextcloud serverJun 11, 2021

  • CVE-2020-8180
    40Plan

    A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by a

    CriticalCVSS 9.9No exploitEPSS 2%

    nextcloud · talkJun 8, 2020

  • CVE-2023-49792
    39Monitor

    Bruteforce protection can be bypassed with misconfigured proxy

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    nextcloud · nextcloud serverDec 22, 2023

  • CVE-2023-48307
    39Monitor

    Nextcloud Mail app vulnerable to Server-Side Request Forgery

    CriticalCVSS 9.8No exploitEPSS 1%

    nextcloud · mailNov 21, 2023

  • CVE-2023-32074
    39Monitor

    Nextcloud user_oidc app is missing brute force protection

    CriticalCVSS 9.8No exploitEPSS 1%

    nextcloud · user oidcMay 25, 2023

  • CVE-2023-48306
    39Monitor

    Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRF

    CriticalCVSS 9.8No exploitEPSS 1%

    nextcloud · nextcloud serverNov 21, 2023

  • CVE-2024-22212
    39Monitor

    Nextcloud global site selector authentication bypass

    CriticalCVSS 9.8No exploitEPSS 1%

    nextcloud · global site selectorJan 18, 2024

  • CVE-2022-31132
    39Monitor

    Unauthenticated SSRF in 3rd party module "cerdic/csstidy"

    CriticalCVSS 9.8No exploitEPSS 1%

    nextcloud · mailAug 4, 2022

  • CVE-2021-32654
    37Monitor

    Attacker can obtain write access to any federated share/public link

    CriticalCVSS 9.1No exploitEPSS 2%

    nextcloud · nextcloud serverJun 1, 2021

  • CVE-2021-22879
    36Monitor

    Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious serve

    HighCVSS 8.8No exploitEPSS 5%

    nextcloud · desktopApr 14, 2021

  • CVE-2023-26482
    36Monitor

    Scope of workflow operations is not validated in nextcloud server

    HighCVSS 8.8WeaponizedEPSS 4%

    nextcloud · nextcloud serverMar 30, 2023

  • CVE-2023-31128
    36Monitor

    NextCloud Cookbook's pull-checks.yml workflow is vulnerable to OS Command Injection

    HighCVSS 8.8No exploitEPSS 3%

    nextcloud · cookbookMay 26, 2023

  • CVE-2019-12739
    36Monitor

    lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacte

    HighCVSS 8.8No exploitEPSS 3%

    nextcloud · extractJun 5, 2019

  • CVE-2021-32688
    36Monitor

    Application specific tokens can change their own scope

    HighCVSS 8.8No exploitEPSS 2%

    nextcloud · nextcloud serverJul 12, 2021

  • CVE-2023-35172
    36Monitor

    Nextcloud Server password reset endpoint is not brute force protected

    CriticalCVSS 9.1No exploitEPSS 1%

    nextcloud · nextcloud serverJun 23, 2023

  • CVE-2024-46958
    36Monitor

    In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or

    CriticalCVSS 9.1No exploitEPSS 1%

    nextcloud · desktopSep 15, 2024

  • CVE-2020-8227
    35Monitor

    Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files ou

    MediumCVSS 6.8No exploitEPSS 26%

    nextcloud · desktopAug 21, 2020

  • CVE-2026-22683
    35Monitor

    Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE

    HighCVSS 8.7Proof of conceptEPSS 3%

    windmill · windmillApr 7, 2026

  • CVE-2021-32656
    35Monitor

    Trusted servers exchange can be triggered by attacker

    HighCVSS 8.6No exploitEPSS 2%

    nextcloud · nextcloud serverJun 1, 2021