CO
Product
Contacts
7
CVEs
0
On KEV
5.4
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 7Low 0
Watch
Add Contacts to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-66554 | 5.4 | Dec 5 | Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing Affected: 5.0.0 before 5.5.4; 6.0.0 before 6.0.6; 7.0.0 before 7.2.5 |
| CVE-2021-39221 | 5.4 | Oct 25 | Nextcloud is an open-source, self-hosted productivity platform Affected: before 4.0.3 |
| CVE-2020-8281 | 5.4 | Jan 6 | A missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious SVG files to perform cross-site scripting (XSS) attacks Affected: before 3.4.0 |
| CVE-2020-8280 | 5.4 | Jan 6 | A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scripting (XSS) attacks Affected: before 3.4.1 |
| CVE-2018-3764 | 4.8 | Jul 5 | In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction Affected: before 2.1.2 |
| CVE-2023-33182 | 4.3 | May 30 | Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing Affected: 4.1.0 before 4.2.4; 5.0.0 before 5.0.3 |
| CVE-2020-8181 | 4.3 | Jul 10 | A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars Affected: before 3.3.0 |
Showing 7