Vendor
dgtlmoon
30 known vulnerabilities.
Products
11 results · Clear filters · Feed
-
Medium 4.3
dgtlmoon changedetection.io visual_selector_data flask_app.py static_content path traversal
A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_content of the file changedetectionio/flask_app.py of the component visual_selector_data. Executing a manipulation of the argument filename can lead t…
-
Medium 4.2
changedetection.io through 0.60.6 Cross-Site Scripting via watch_title
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as li…
-
Medium 6.5CVE-2026-71205 Public exploit
changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).
-
Medium 6.3CVE-2026-71204 Public exploit
changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement
changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.
-
Medium 5.3CVE-2026-71203 Public exploit
changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema
changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.…
-
Medium 6.5
ChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File Read
ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-acc…
-
Medium 6.1
changedetection.io: Reflected XSS in RSS Tag Error Response
changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected cross-site scripting (XSS) vulnerability identified in the /rss/tag/ endpoint of changedetection.io. The tag_uuid path parameter is reflecte…
-
Medium 6.1CVE-2026-27645 Scanner template
changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by def…
-
Medium 5.3CVE-2026-25527 Scanner template
changedetection.io vulnerable to unauthenticated static path traversal
changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` route accepts `group=".."`, which causes `send_from_directory("static/..", filename)` to execute. This moves the base direct…
-
Medium 6.9CVE-2024-51483 Scanner template
changedetection.io Path Traversal vulnerability
changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passw…
-
Medium 4.3CVE-2024-34061 Scanner template
Reflected cross site scripting in changedetection.io
changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in parameter notification_urls is not processed resulting in javascript execution in the application. A r…