ΠΠΎΠ»ΠΈΡΠ΅ΡΡΠ²ΠΎ 6
ΠΠΎΠ»ΠΈΡΠ΅ΡΡΠ²ΠΎ 6
CVE-2025-59788
Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.
CVE-2025-59788
Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewe ...
ROS-20260524-80-0053
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ nextcloud
ROS-20260524-73-0054
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ nextcloud
GHSA-88cv-g9gq-h6pq
Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.
BDU:2026-07783
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ ΠΏΡΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΡ Π΄Π»Ρ ΠΈΠ½ΡΠ΅Π³ΡΠ°ΡΠΈΠΈ Π±ΠΈΠ±Π»ΠΈΠΎΡΠ΅ΠΊΠΈ PDF.js files_pdfviewer ΠΎΠ±Π»Π°ΡΠ½ΠΎΠ³ΠΎ ΠΏΡΠΎΠ³ΡΠ°ΠΌΠΌΠ½ΠΎΠ³ΠΎ ΠΎΠ±Π΅ΡΠΏΠ΅ΡΠ΅Π½ΠΈΡ Π΄Π»Ρ ΡΠΎΠ·Π΄Π°Π½ΠΈΡ ΠΈ ΠΈΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΡ Ρ ΡΠ°Π½ΠΈΠ»ΠΈΡΠ° Π΄Π°Π½Π½ΡΡ Nextcloud Server, ΠΏΠΎΠ·Π²ΠΎΠ»ΡΡΡΠ°Ρ Π½Π°ΡΡΡΠΈΡΠ΅Π»Ρ ΠΏΡΠΎΠ²ΠΎΠ΄ΠΈΡΡ ΠΌΠ΅ΠΆΡΠ°ΠΉΡΠΎΠ²ΡΠ΅ ΡΡΠ΅Π½Π°ΡΠ½ΡΠ΅ Π°ΡΠ°ΠΊΠΈ (XSS)
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΠ΅ΠΉ Π½Π° ΡΡΡΠ°Π½ΠΈΡΡ
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ | CVSS | EPSS | ΠΠΏΡΠ±Π»ΠΈΠΊΠΎΠ²Π°Π½ΠΎ | |
|---|---|---|---|---|
 | CVE-2025-59788 Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis. | CVSS3: 6.4 | 0% ΠΠΈΠ·ΠΊΠΈΠΉ | 9 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ |
| CVE-2025-59788 Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewe ... | CVSS3: 6.4 | 0% ΠΠΈΠ·ΠΊΠΈΠΉ | 9 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ |
 | ROS-20260524-80-0053 Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ nextcloud | CVSS3: 5.4 | 0% ΠΠΈΠ·ΠΊΠΈΠΉ | 4 ΠΌΠ΅ΡΡΡΠ° Π½Π°Π·Π°Π΄ |
| ROS-20260524-73-0054 Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ nextcloud | CVSS3: 5.4 | 0% ΠΠΈΠ·ΠΊΠΈΠΉ | 4 ΠΌΠ΅ΡΡΡΠ° Π½Π°Π·Π°Π΄ |
| GHSA-88cv-g9gq-h6pq Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis. | CVSS3: 6.4 | 0% ΠΠΈΠ·ΠΊΠΈΠΉ | 9 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ |
 | BDU:2026-07783 Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ ΠΏΡΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΡ Π΄Π»Ρ ΠΈΠ½ΡΠ΅Π³ΡΠ°ΡΠΈΠΈ Π±ΠΈΠ±Π»ΠΈΠΎΡΠ΅ΠΊΠΈ PDF.js files_pdfviewer ΠΎΠ±Π»Π°ΡΠ½ΠΎΠ³ΠΎ ΠΏΡΠΎΠ³ΡΠ°ΠΌΠΌΠ½ΠΎΠ³ΠΎ ΠΎΠ±Π΅ΡΠΏΠ΅ΡΠ΅Π½ΠΈΡ Π΄Π»Ρ ΡΠΎΠ·Π΄Π°Π½ΠΈΡ ΠΈ ΠΈΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΡ Ρ ΡΠ°Π½ΠΈΠ»ΠΈΡΠ° Π΄Π°Π½Π½ΡΡ Nextcloud Server, ΠΏΠΎΠ·Π²ΠΎΠ»ΡΡΡΠ°Ρ Π½Π°ΡΡΡΠΈΡΠ΅Π»Ρ ΠΏΡΠΎΠ²ΠΎΠ΄ΠΈΡΡ ΠΌΠ΅ΠΆΡΠ°ΠΉΡΠΎΠ²ΡΠ΅ ΡΡΠ΅Π½Π°ΡΠ½ΡΠ΅ Π°ΡΠ°ΠΊΠΈ (XSS) | CVSS3: 5.5 | 0% ΠΠΈΠ·ΠΊΠΈΠΉ | ΠΎΠΊΠΎΠ»ΠΎ 1 Π³ΠΎΠ΄Π° Π½Π°Π·Π°Π΄ |
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΠ΅ΠΉ Π½Π° ΡΡΡΠ°Π½ΠΈΡΡ