o
ownCloud
Security Risk Profile
68
/100
highSecurity Risk Score
Comprehensive risk assessment based on 179 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from April 20, 2012 to present
179
Total CVEs
36
Critical+High
2
Exploited
30
Unpatched
Threat Assessment
Avg CVSS
5.7
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
30
Critical/High
Risk Level
68/100
high
⚠️ 2 Active Exploits⚡ 1 Zero-Days
Severity Distribution
Critical
13High
23Medium
123Low
17Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
0Age Distribution
Common Weaknesses (CWE)
1
XSS
46
2
CSRF
14
3
Infoleak
13
4
Path Traversal
8
5
Input Validation
8
Most Affected Products
1. ownCloud ownCloud1577
2. ownCloud ownCloud Server1377
3. Happyworm Jplayer73
4. Mediaelementjs Mediaelement.js71
5. Fruux Sabredav37
Recent Vulnerabilities
See more →CVE-2025-53831
CVSS 8.2high
DrawIO for ownCloud 10 is vulnerable to Stored XSS
Jul 6, 2026🔧 No Patch
CVE-2025-53830
CVSS 9.1critical
Anti-Virus for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)
Jul 6, 2026🔧 No Patch
CVE-2025-53829
CVSS 8.0high
ownCloud 10 is vulnerable to Relative Path Traversal
Jul 6, 2026🔧 No Patch
CVE-2025-53828
CVSS 8.5high
SharePoint for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)
Jul 6, 2026🔧 No Patch
CVE-2025-53827
CVSS 9.1critical
ownCloud Core: Updater has an exposed dangerous method or function
Jul 6, 2026🔧 No Patch
CVE-2019-25337
CVSS 5.3medium
OwnCloud 8.1.8 - Username Disclosure
Feb 12, 2026🔧 No Patch
CVE-2025-59716
CVSS 5.3medium
Nov 5, 2025🔧 No Patch
https://www.bleepingcomputer.com/news/security/surge-in-attacks-exploiting-old-thinkphp-and-owncloud-flaws/
unknown
Surge in attacks exploiting old ThinkPHP and ownCloud flaws
Feb 12, 2025⚠ Exploited⚡ Zero-Day🔧 No Patch
CVE-2024-50657
CVSS 6.8medium
Nov 22, 2024🔧 No Patch
CVE-2023-49105
CVSS 9.8critical
Nov 21, 2023🔧 No Patch
Monitor ownCloud in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.