CVE-2023-28644

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server performances and/or can lead to a denial of service. This issue has been addressed and it is recommended that the Nextcloud Server is upgraded to 25.0.3. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Mar 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-286456.5Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the CVE-2023-286462.4Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an at CVE-2023-286476.8Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker h CVE-2023-286486.1Osprey Pump Controller version 1.01 inputs passed to a GET parameter are not properly sanitized before being returned to the user. This can CVE-2023-286497.5The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists CVE-2023-28659.8A vulnerability was found in SourceCodester Theme Park Ticketing System 1.0. It has been classified as critical. This affects an unknown par CVE-2023-286506.1An unauthenticated remote attacker could provide a malicious link and trick an unsuspecting user into clicking on it. If clicked, the attack CVE-2023-286514.8Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. If a user who can access the affected produ CVE-2023-286526.5An authenticated malicious user could successfully upload a malicious image could lead to a denial-of-service condition.CVE-2023-286537.8The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to a use-afte CVE-2023-286549.8Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full access to the web m CVE-2023-286555.4A malicious user could leverage this vulnerability to escalate privileges or perform unauthorized actions in the context of the targeted pri