{"id":"CVE-2016-9466","aliases":["EUVD-2016-10272","GHSA-m5x2-59hv-phpr"],"status":"published","title":"Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS...","description":"Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly sanitizing exception messages from the Nextcloud/ownCloud server. Due to an endpoint where an attacker could influence the error message, this led to a reflected Cross-Site-Scripting vulnerability.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01656,"percentile":0.76759,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2017-03-28T02:46:00Z","modified":"2026-10-24T10:47:30Z","products":[{"vendor":"nextcloud","product":"nextcloud_server"},{"vendor":"owncloud","product":"owncloud"}],"references":[{"url":"https://nextcloud.com/security/advisory/?id=nc-sa-2016-009","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://github.com/nextcloud/gallery/commit/f9ef505c1d60c9041e251682e0f6b3daad952d58","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://hackerone.com/reports/165686","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://owncloud.org/security/advisory/?id=oc-sa-2016-019","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://github.com/owncloud/gallery/commit/dc4887f1afcc0cf304f4a0694075c9364298ad8a","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/owncloud/gallery/commit/b3b3772fb9bec61ba10d357bef42b676fa474eee","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9466"},{"url":"https://github.com/advisories/GHSA-m5x2-59hv-phpr"}],"sources":{"cve":[{"id":"CVE-2016-9466","description":"Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly sanitizing exception messages from the Nextcloud/ownCloud server. Due to an endpoint where an attacker could influence the error message, this led to a reflected Cross-Site-Scripting vulnerability.","status":"published","published":"2017-03-28T02:46:00Z","modified":"2024-08-06T02:50:38.485Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:32.103757Z"}],"euvd":[{"id":"EUVD-2016-10272","description":"Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly sanitizing exception messages from the Nextcloud/ownCloud server. Due to an endpoint where an attacker could influence the error message, this led to a reflected Cross-Site-Scripting vulnerability.","status":"published","published":"2017-03-28T02:46:00Z","modified":"2024-08-06T02:50:38Z","updated_at":"2026-11-03T02:22:27.235814Z"}],"ghsa":[{"id":"GHSA-m5x2-59hv-phpr","title":"Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS...","description":"Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly sanitizing exception messages from the Nextcloud/ownCloud server. Due to an endpoint where an attacker could influence the error message, this led to a reflected Cross-Site-Scripting vulnerability.","status":"published","published":"2022-05-13T01:38:32Z","modified":"2023-02-01T05:08:58Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:50:53.78471Z"}],"nvd":[{"id":"CVE-2016-9466","description":"Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly sanitizing exception messages from the Nextcloud/ownCloud server. Due to an endpoint where an attacker could influence the error message, this led to a reflected Cross-Site-Scripting vulnerability.","status":"published","published":"2017-03-28T02:59:01.107Z","modified":"2026-06-17T00:56:07.513Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:37.238712Z"}],"osv":[{"id":"CVE-2016-9466","description":"Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly sanitizing exception messages from the Nextcloud/ownCloud server. Due to an endpoint where an attacker could influence the error message, this led to a reflected Cross-Site-Scripting vulnerability.","status":"published","published":"2017-03-28T02:59:01.107Z","modified":"2026-10-24T10:47:30.697999858Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:03.472693Z"}]}}