Nextcloud
Nextcloud Mail: vulnerabilidades y CVE
Nextcloud Mail tiene 15 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE15
Últimos 12 meses1
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-66514 | Media (5.4) | 0.25% | — | 5 dic 2025 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email… |
| CVE-2024-52509 | Media (5.7) | 0.51% | — | 15 nov 2024 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to… |
| CVE-2024-52508 | Alta (8.1) | 0.71% | — | 15 nov 2024 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like user@example.tld that does not support auto configuration, and… |
| CVE-2023-48307 | Crítica (9.8) | 0.87% | — | 21 nov 2023 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker can use an unprotected endpoint in the Mail app to perform… |
| CVE-2023-45660 | Media (4.3) | 0.60% | — | 16 oct 2023 | Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third… |
| CVE-2023-33184 | Media (5.3) | 0.53% | — | 27 may 2023 | Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3. |
| CVE-2023-25160 | Media (5.3) | 0.46% | — | 13 feb 2023 | Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box by ID getting the subjects and the first characters of the… |
| CVE-2023-23943 | Media (4.3) | 0.92% | — | 6 feb 2023 | Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network… |
| CVE-2023-23944 | Media (6.5) | 0.47% | — | 6 feb 2023 | Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure. Any attacker or… |
| CVE-2022-31119 | Media (4.9) | 0.81% | — | 4 ago 2022 | Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwords to disk in the event of a misconfiguration. Should an attacker gain access to… |
| CVE-2022-31132 | Crítica (9.8) | 0.70% | — | 4 ago 2022 | Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path `./vendor/cerdic/css-tidy/css_optimiser.php`. Access to the minifier is… |
| CVE-2021-39220 | Baja (3.5) | 0.78% | — | 25 oct 2021 | Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP. The… |
| CVE-2021-32707 | Media (4.3) | 1.1% | — | 12 jul 2021 | Nextcloud Mail is a mail app for Nextcloud. In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images in emails to not leak the read state. The privacy filter failed to filter images… |
| CVE-2021-32652 | Media (4.3) | 1.1% | — | 1 jun 2021 | Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1.8.2 allows another authenticated users to access mail metadata of other users. Versions 1.4.3 and… |
| CVE-2020-8156 | Alta (7) | 0.96% | — | 12 may 2020 | A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack. |