ownCloud Guests - User Enumeration

ownCloud Guests before 0.12.5 contains an unauthenticated user enumeration vulnerability caused by insufficient validation of the token in showPasswordForm at /apps/guests/register/email/token, letting unauthenticated attackers enumerate valid guest users, exploit requires no authentication. id:...

VulnCheck KEV: CVE-2025-59716

ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/email/token endpoint. Because of insufficient validation of the supplied token in showPasswordForm, the server responds differently when an e-mail address corresponds to a valid pending guest user...

CVE-2025-59716

ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/email/token endpoint. Because of insufficient validation of the supplied token in showPasswordForm, the server responds differently when an e-mail address corresponds to a valid pending guest user...

PT-2025-45141

Name of the Vulnerable Software and Affected Versions ownCloud Guests versions prior to 0.12.5 Description The application allows unauthenticated user enumeration through the /apps/guests/register/email/token API endpoint. Insufficient validation of the supplied token within the showPasswordForm...

Malicious code in owncloud-guests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a28ce9d423c6b78dce7622581d188d106a8e067adba46e06fd1bd29d76ab12b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5162 Malicious code in owncloud-guests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a28ce9d423c6b78dce7622581d188d106a8e067adba46e06fd1bd29d76ab12b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview owncloud-guests is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...