dgtlmoon

4 results · Clear filters · Feed

• Medium 6.5
  CVE-2026-71205 Public exploit

  changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force

  changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).

  dgtlmoon changedetection.io
  Aug 5, 2026
• Medium 6.3
  CVE-2026-71204 Public exploit

  changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement

  changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.

  dgtlmoon changedetection.io
  Aug 5, 2026
• Medium 5.3
  CVE-2026-71203 Public exploit

  changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema

  changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.…

  dgtlmoon changedetection.io
  Aug 5, 2026
• Critical 10.0
  CVE-2024-32651 Public exploit Scanner template EPSS 85%

  Server Side Template Injection in Jinja2 allows Remote Command Execution

  changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run an…

  dgtlmoon changedetection.io changedetection-io PyPI
  Apr 25, 2024