CVE-2016-9465

CVE-2016-9465

Vendor N/A
Product Nextcloud Server & ownCloud Server Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2
Weakness CWE-79 · XSS
Published March 28, 2017
Last update August 6, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack.

Key dates

02Disclosure timeline

March 28, 2017 CVE published
August 6, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-2645 PHPGurukul Art Gallery Management System product.php cross site scripting CVE-2026-25305 WordPress XStore theme <= 9.6.4 - Cross Site Scripting (XSS) vulnerability CVE-2024-47107 IBM QRadar SIEM cross-site scripting CVE-2023-39971 Extension - acymailing.com - XSS in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3 CVE-2025-66310 Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab