3.5Baja
Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title field
nextcloud security-advisories
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. Javascript and…