CVE-2022-39333 MEDIUM

CVE-2022-39333: Cross-site scripting (XSS) in Nextcloud Desktop Client

Vendor Nextcloud
Product security-advisories
Weakness CWE-79 · XSS
Published November 25, 2022
Last update November 3, 2025
View on NVD All CVEs

CVSS base score

4.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.

Key dates

02Disclosure timeline

November 25, 2022 CVE published
November 3, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-8741 Beam me up Scotty – Back to Top Button <= 1.0.21 - Reflected Cross-Site Scripting CVE-2024-34563 WordPress Gold Addons for Elementor plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability CVE-2025-2711 Yonyou UFIDA ERP-NC systop.jsp cross site scripting CVE-2025-23616 WordPress Canalplan plugin <= 5.31 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-12499 WP jQuery DataTable <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting