owncloud-exploits

ownCloud exploits for CVE-2023-49105 Refer to the article for details about the bug. Provided for educational purposes only...

ownCloud_RCE_CVE-2013-0303

This repository does not have a README...

CVE-2024-37010

CVE-2024-37010 Exploit for the CVE-2024-37010: access other user's external storage & lateral movement: https://www.cert.ssi.gouv.fr/avis/CERTFR-2024-AVI-0753/ https://owncloud.com/security-advisories/insecure-direct-object-reference-in-external-storage Intro Owncloud turns a server into a cloud...

CVE-2024-50657

CVE-2024-50657:Incorrect Access Control on Owncloud apk An issue in Owncloud android apk v.4.4.1 allows a physically proximate attacker to escalate privileges via the PassCodeViewModel class, specifically in the checkPassCodeIsValid method. Vulnerability Type Incorrect Access Control Vendor of...

ownCloud Guests - User Enumeration

ownCloud Guests before 0.12.5 contains an unauthenticated user enumeration vulnerability caused by insufficient validation of the token in showPasswordForm at /apps/guests/register/email/token, letting unauthenticated attackers enumerate valid guest users, exploit requires no authentication. id:...

cve-2026-23989-opencloud-lab

CVE-2026-23989 — OpenCloud / ownCloud Infinite Scale 공개 링크 범위 우회 공식 업스트림 Docker 이미지를 사용하여 CVE-2026-23989 를 재현하고 수정 여부를 검증하는, 단일 명령으로 실행되는 독립형 랩입니다. 하나의 폴더 에 대한 접근 권한을 부여해야 하는 공개 공유 링크가 해당 폴더의 범위 밖 에 있는 파일을 읽는 데 악용될 수 있습니다. | ---|--- CVE| CVE-2026-23989 Advisory| GHSA-vf5j-r2hw-2hrw "Public Link...

OwnCloud - Phpinfo Configuration

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...

CVE-2017-10797

CVE-2017-10797 CVE-2017-10797- OwnCloud Server 8.1-10.0에서의 사용자 열거...

OwnCloud-CVE-2023-49103

컨테이너를 빌드하려면 다음을 수행하세요: 1: 폴더를 다운로드하고 압축을 푼 다음 컨테이너를 빌드합니다. 2: docker build -t cve-2023-49103 ./ 3: docker run --name cve-2023-49103 -p 80:80 -p 443:443 cve-2023-49103...

CVE-2023-49103

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 우리는 테러 조직 하마스에 의해 인질로 잡힌 모든 시민의 안전한 귀환을 요구합니다. 모든 인질이 석방되어 안전하게 귀환할 때까지 우리는 쉬지 않을 것입니다. 여러분도 그들을 집으로 데려오는 데 도움을 줄 수 있습니다.https://stories.bringthemhomenow.net/ CVE-2023-49103 익스플로잇 배경 ownCloud는 엔터프라이즈 환경을 위해 설계된 파일 공유 플랫폼입니다. 2023년 11월 21일, ownCloud는 "Graph...

CVE-2026-84282

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

CVE-2026-84282

A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12) developed by Ascensio System SIA . The /apps/onlyoffice/ajax/settings/address endpoint fails to sufficiently validate user-supplied Document Server URLs before initiating outboun...

CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

PT-2026-87103

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

CVE-2026-84282: Undefined Security Weakness

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

Overview A Server-Side Request Forgery SSRF vulnerability exists in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12. The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections. An authenticated...

Exploit for Incorrect Authorization in Heinlein Opencloud_Reva

CVE-2026-23989 — OpenCloud / ownCloud Infinite Scale public-li...

ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnerabilities KEV catalog following reports that a Chinese-speaking threat actor weaponized the vulnerability to target a nuclear research body in...