Nextcloud · Report #508487
Arbitrary SQL command injection
Validstatus
criticalseverity
77upvotes
21 Jul 2019disclosed
Summary
When querying for users on the lookup server any unauthenticated user could perform an SQL Injection.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.