Browse / Nextcloud

Nextcloud

See its reports on the map

Attack surface: 1,639 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Nextcloud

• Access Control105
• Information Disclosure104
• Authentication82
• Misconfiguration65
• Cross-site Scripting56
• Other weaknesses26

Most upvoted reports

AllValidInformativeN/ADuplicate

1. IDOR on ██████ via direct photo URL leads to unauthorized access to deleted and other users' photosN/AInsecure Direct Object Reference (IDOR)
   37 votes
2. Unauthenticated Stored xss N/ACross-site Scripting (XSS) - Generic
   14 votes
3. Nextcloud Server Remote Command ExecutionN/ACode Injection · high
   4 votes
4. Clickjacking In https://demo.nextcloud.comN/AUI Redressing (Clickjacking) · critical
   4 votes
5. Information disclosureN/AInformation Disclosure
   4 votes