Vulnerability Database

309,961

Total vulnerabilities in the database

CVE-2016-7419

Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name.

Published: Sep 17, 2016
Updated: Nov 9, 2025
CVE: CVE-2016-7419
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 3.5
AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
nextcloud / nextcloud_server	-	9.0.51.x
owncloud / owncloud	-	9.0.3.x

http://www.securityfocus.com/bid/92373
https://github.com/nextcloud/gallery/commit/6933d27afe518967bd1b60e6a7eacd88288929fc
https://hackerone.com/reports/145355
https://nextcloud.com/security/advisory/?id=nc-sa-2016-001
https://owncloud.org/security/advisory/?id=oc-sa-2016-011

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo