Browse through the OwnCloud release notes. Almost every version has fixes for XSS and remote code execution. Fixes are great but the developers seem to be making the same mistakes over and over again. It is just too easy to do that in PHP.