description: Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.
problem types: Cross-site Scripting (XSS) - Reflected (CWE-79)
affected:
{
product: Nextcloud Server
vendor: n/a
versions:
status: affected, version: 15.0.6
}