Browse / Nextcloud

Nextcloud

See its reports on the map

Attack surface: 1,639 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Nextcloud

• Access Control105
• Information Disclosure104
• Authentication82
• Misconfiguration65
• Cross-site Scripting56
• Other weaknesses26

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Wordpress Users DisclosureDuplicateInformation Disclosure · high
   8 votes
2. NextCloud is also Accepting OCTET-STREAM Type of Documents instead of jpg or Imge Files OnlyDuplicateImproper Authentication - Generic
   7 votes
3. Email SpoofingDuplicatePhishing · medium
   6 votes
4. Missing SPF Flags on nextcloud.comDuplicateViolation of Secure Design Principles
   5 votes
5. Disclosed Version of PORTS SSH|HTTP|SSLDuplicateInformation Disclosure · low
   4 votes
6. The email API to reset password is unlimited and can be used as a email bombDuplicateImproper Access Control - Generic · low
   4 votes
7. No rate limiting on password protected shared file linkDuplicateImproper Authentication - Generic
   3 votes
8. Reflected Self-XSS Vulnerability in the Comment section of Files (Different-payloads)DuplicateCross-site Scripting (XSS) - Generic
   2 votes
9. Nextcloud Clickjacking VulnerabilityDuplicateUI Redressing (Clickjacking) · low
   1 votes
10. Clickjacking on https://download.nextcloud.com/DuplicateUI Redressing (Clickjacking)
    1 votes
11. Clickjacking on https://download.nextcloud.comDuplicateUI Redressing (Clickjacking)
    1 votes
12. Information Exposure Through Directory Listing - https://apps.nextcloud.com/static/DuplicateInformation Exposure Through Directory Listing · low
    1 votes
13. Clickjacking on https://nextcloud.com/DuplicateUI Redressing (Clickjacking)