| Package | Affected versions | Patched versions |
|---|---|---|
| calendar | = 1.6.0< 1.5.8 | 1.5.8 |
In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free