description: Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.
problem types: Cross-site Scripting (XSS) - Reflected (CWE-79)
affected:
{
product: Nextcloud Server
vendor: n/a
versions:
status: affected, version: Fixed in 20.0.6
}