UpHeron
All vulnerabilities

Servers and applications

CVE-2018-3780

A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users.

Severity
Medium 5.4
Published
13 Aug 2018
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
13.0.5
Sources
NVD

Affected software

SoftwareAffected versions
NextcloudServers and applications · cpe:a:nextcloud:nextcloud_server
  • Every version before 13.0.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-3780
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-3780