ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 are vulnerable to XSS on error pages by injecting code in url parameters.
| Software | From | Fixed in |
|---|---|---|
| owncloud / owncloud | - | 8.2.11.x |
| owncloud / owncloud | 9.0.0 | 9.0.9.x |
| owncloud / owncloud | 9.1.0.x | 9.1.5.x |
| owncloud / owncloud | 10.0.0 | 10.0.2 |