CVE-2023-49103

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ Exploit for...

CVE-2017-10797

CVE-2017-10797 CVE-2017-10797- User Enumeration in OwnCloud Server 8.1-10.0...

ownCloud_RCE_CVE-2013-0303

Este repositorio no tiene un README...

CVE-2024-37010

CVE-2024-37010 Exploit for the CVE-2024-37010: access other user's external storage & lateral movement: https://www.cert.ssi.gouv.fr/avis/CERTFR-2024-AVI-0753/ https://owncloud.com/security-advisories/insecure-direct-object-reference-in-external-storage Intro Owncloud turns a server into a cloud...

ownCloud Guests - User Enumeration

ownCloud Guests before 0.12.5 contains an unauthenticated user enumeration vulnerability caused by insufficient validation of the token in showPasswordForm at /apps/guests/register/email/token, letting unauthenticated attackers enumerate valid guest users, exploit requires no authentication. id:...

OwnCloud-CVE-2023-49103

To build the container do: 1: Down the folder, unzip and build the container. 2: docker build -t cve-2023-49103 ./ 3: docker run --name cve-2023-49103 -p 80:80 -p 443:443 cve-2023-49103...

owncloud-exploits

CVE-2023-49105 用 ownCloud エクスプロイト バグの詳細については、記事を参照してください。 教育目的のみで提供されています。...

OwnCloud - Phpinfo Configuration

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...

CVE-2024-50657

CVE-2024-50657: Control de Acceso Incorrecto en la apk de Owncloud Un problema en la apk de Owncloud para Android v.4.4.1 permite a un atacante físicamente cercano escalar privilegios a través de la clase PassCodeViewModel, específicamente en el método checkPassCodeIsValid. Tipo de Vulnerabilidad...

cve-2026-23989-opencloud-lab

CVE-2026-23989 — OpenCloud / ownCloud Infinite Scale 公開リンクのスコープバイパス 公式のアップストリームDockerイメージを使用して、CVE-2026-23989 を再現し、修正を確認する自己完結型のワンコマンドラボです。1つのフォルダ へのアクセスを許可するはずの公開共有リンクが、そのフォルダのスコープ外 のファイルを読み取るために悪用される可能性があります。...

CVE-2026-84282

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

CVE-2026-84282

A Server-Side Request Forgery (SSRF) vulnerability in the ONLYOFFICE ownCloud Integration plugin v9.12 (Ascensio System SIA) allows an authenticated administrator to force the ownCloud server to issue arbitrary outbound requests. The vulnerable endpoint is /apps/onlyoffice/ajax/settings/address, ...

CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

Overview A Server-Side Request Forgery SSRF vulnerability exists in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12. The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections. An authenticated...

ownCloud Improper Authentication Vulnerability

ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured...

VulnCheck KEV: CVE-2023-49105

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no...

CVE-2025-53831

DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud prior to version 1.0.2, which corresponds to ownCloud 10 prior to version 10.15.3, attackers with access to the DrawIO app can leverage...

CVE-2025-53831 DrawIO for ownCloud 10 is vulnerable to Stored XSS

DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud prior to version 1.0.2, which corresponds to ownCloud 10 prior to version 10.15.3, attackers with access to the DrawIO app can leverage...

CVE-2025-53831

DrawIO for ownCloud is affected by a Stored XSS in older builds. The vulnerability stems from improper neutralization of user-supplied input during web page generation, enabling stored XSS when attackers have access to the DrawIO app. Affected range includes DrawIO for ownCloud < 1.0.2 (corres...