{"kind": "product", "path": "vulns/pypi/changedetection-io", "name": "changedetection-io", "product": "changedetection-io", "ecosystem": "PyPI", "items": [{"id": "CVE-2026-43891", "noindex": false, "published": "2026-05-12T16:56:33.823Z", "modified": "2026-05-13T14:36:51.163Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00354, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-43891", "title": "changedetection.io: Arbitrary Local File Read via crafted backup restore", "description": "changedetection.io is a free open source web page change detection tool. Prior to 0.55.1, the vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files. The vulnerable flow starts in the backup restore logic. When a backup ZIP is restored, the application extracts the archive and copies each restored watch UUID directory directly into the live datastore using shutil.copytree(entry.path, dst_dir). This preserves attacker-controlled files inside the restored watch directory, including history.txt. After restore, the application parses history.txt in the watch history property and  returns the contents of ", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-8757-69j2-hx56", "https://github.com/pocket-id/pocket-id/security/advisories/GHSA-w6p7-2fxx-4f44", "https://nvd.nist.gov/vuln/detail/CVE-2026-43891"], "fixes": ["0.55.1"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-41895", "noindex": false, "published": "2026-05-12T16:52:23.680Z", "modified": "2026-05-18T15:10:39.585Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00266, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-41895", "title": "changedetection.io: XXE vulnerability in the changedetection.io project", "description": "changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLParser(strip_cdata=False) without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with etree.fromstring(...).", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-v7cp-2cx9-x793", "https://nvd.nist.gov/vuln/detail/CVE-2026-41895"], "fixes": ["0.54.10"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}, {"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-35490", "noindex": false, "published": "2026-04-07T14:55:24.120Z", "modified": "2026-04-09T14:37:01.267Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.00536, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-35490", "title": "changedetection.io has an Authentication Bypass via Decorator Ordering", "description": "changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login_optionally_required decorator is placed before (outer to) @blueprint.route() instead of after it. In Flask, @route() must be the outermost decorator because it registers the function it receives. When the order is reversed, @route() registers the original undecorated function, and the auth wrapper is never in the call chain. This silently disables authentication on these routes. This vulnerability is fixed in 0.54.8.", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-jmrh-xmgh-x9j4", "https://nvd.nist.gov/vuln/detail/CVE-2026-35490"], "fixes": ["0.54.8"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-35000", "noindex": false, "published": "2026-04-01T18:09:35.793Z", "modified": "2026-07-14T18:40:38.826Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00293, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-35000", "title": "ChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File Read", "description": "ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. Attackers can exploit the incomplete blocklist of dangerous XPath functions to access sensitive data from the local filesystem.", "references": ["https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.7", "https://github.com/dgtlmoon/changedetection.io/commit/dadc804567a51f803cd6715f7885c11a247915f6", "https://www.vulncheck.com/advisories/changedetection-io-safexpath3parser-bypass-arbitrary-file-read"], "fixes": ["0.54.7"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-33981", "noindex": false, "published": "2026-03-27T22:01:13.719Z", "modified": "2026-03-30T18:36:23.805Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "severity": "high", "epss": 0.00484, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-33981", "title": "Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters", "description": "changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the `jq:` and `jqraw:` include filter expressions allow use of the jq `env` builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user (or unauthenticated user when no password is set, the default) can leak sensitive environment variables including `SALTED_PASS`, `PLAYWRIGHT_DRIVER_URL`, `HTTP_PROXY`, and any secrets passed as env vars to the container. Version 0.54.7 patches the issue.", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-58r7-4wr5-hfx8", "https://github.com/dgtlmoon/changedetection.io/commit/65517a9c74a0cbe1a4661314470b28131ef5557f", "https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.7"], "fixes": ["0.54.7"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-29065", "noindex": false, "published": "2026-03-06T06:54:27.792Z", "modified": "2026-03-09T19:59:16.113Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "high", "epss": 0.00586, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-29065", "title": "changedetection.io: Zip Slip vulnerability in the backup restore functionality", "description": "changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerability in the backup restore functionality allows arbitrary file overwrite via path traversal in uploaded ZIP archives. This issue has been patched in version 0.54.4.", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-25g8-2mcf-fcx9", "https://github.com/dgtlmoon/changedetection.io/commit/1d7d812eb0faab37042246e2fbce04f29bb1b3aa", "https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4"], "fixes": ["0.54.4"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-29039", "noindex": false, "published": "2026-03-06T06:54:15.822Z", "modified": "2026-03-09T19:58:22.717Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "high", "epss": 0.00538, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-29039", "title": "changedetection.io: XPath - Arbitrary File Read via unparsed-text()", "description": "changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, the changedetection.io application allows users to specify XPath expressions as content filters via the include_filters field. These XPath expressions are processed using the elementpath library which implements XPath 3.0/3.1 specification. XPath 3.0 includes the unparsed-text() function which can read arbitrary files from the filesystem. The application does not validate or sanitize XPath expressions to block dangerous functions, allowing an attacker to read any file accessible to the application process. This issue has been patched in version 0", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-6fmw-82m7-jq6p", "https://github.com/dgtlmoon/changedetection.io/commit/417d57e5749441e4be9acc4010369bded805d66f", "https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4"], "fixes": ["0.54.4"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-29038", "noindex": false, "published": "2026-03-06T06:53:56.959Z", "modified": "2026-03-09T19:57:44.702Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00319, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-29038", "title": "changedetection.io: Reflected XSS in RSS Tag Error Response", "description": "changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected cross-site scripting (XSS) vulnerability identified in the /rss/tag/ endpoint of changedetection.io. The tag_uuid path parameter is reflected directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. This issue has been patched in version 0.54.4.", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-8whx-v8qq-pq64", "https://github.com/dgtlmoon/changedetection.io/commit/ec7d56f85d1e9690fca7cb4711c1fb20dffec780", "https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4"], "fixes": ["0.54.4"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-27696", "noindex": false, "published": "2026-02-25T04:16:22.764Z", "modified": "2026-02-25T14:51:16.695Z", "cvss": 8.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "severity": "high", "epss": 0.00495, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-27696", "title": "changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs", "description": "changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, changedetection.io is vulnerable to Server-Side Request Forgery (SSRF) because the URL validation function `is_safe_valid_url()` does not validate the resolved IP address of watch URLs against private, loopback, or link-local address ranges. An authenticated user (or any user when no password is configured, which is the default) can add a watch for internal network URLs. The application fetches these URLs server-side, stores the response content, and makes it viewable through the web UI — enabling full data exfiltration from internal services", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-3c45-4pj5-ch7m", "https://github.com/dgtlmoon/changedetection.io/commit/fe7aa38c651d73fe5f41ce09855fa8f97193747b", "https://nvd.nist.gov/vuln/detail/CVE-2026-27696"], "fixes": ["0.54.1"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-27645", "noindex": false, "published": "2026-02-25T04:06:58.183Z", "modified": "2026-02-25T14:55:58.413Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00495, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-27645", "title": "changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response", "description": "changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. Version 0.54.1 contains a fix for the issue.", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-mw8m-398g-h89w", "https://github.com/dgtlmoon/changedetection.io/commit/a385c89abf44b52fcfa20c7c6a6dd3047c4c1eb5", "https://nvd.nist.gov/vuln/detail/CVE-2026-27645"], "fixes": ["0.53.7", "0.54.1"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}, {"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-25527", "noindex": false, "published": "2026-02-19T14:18:18.933Z", "modified": "2026-02-19T15:35:41.155Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.01025, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-25527", "title": "changedetection.io vulnerable to unauthenticated static path traversal", "description": "changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` route accepts `group=\"..\"`, which causes `send_from_directory(\"static/..\", filename)` to execute. This moves the base directory up to `/app/changedetectionio`, enabling unauthenticated local file read of application source files (e.g., `flask_app.py`). Version 0.53.2 fixes the issue.", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-9jj8-v89v-xjvw", "https://github.com/dgtlmoon/changedetection.io/commit/9d38b4517364831889b5b0d7b3465fd060403fd4", "https://nvd.nist.gov/vuln/detail/CVE-2026-25527"], "fixes": ["0.53.2"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-62780", "noindex": false, "published": "2025-11-10T21:18:52.945Z", "modified": "2025-11-10T21:43:52.020Z", "cvss": 3.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "severity": "low", "epss": 0.00462, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-62780", "title": "changedetection.io vulnerable to stored XSS in Watch update via API", "description": "changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in versions prior to 0.50.34 due to insufficient security checks. Two scenarios are possible. In the first, an attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload. In the second, an attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload. When the user clicks on *Preview* and then on the malicious link, the JavaScript ", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4c3j-3h7v-22q9", "https://nvd.nist.gov/vuln/detail/CVE-2025-62780"], "fixes": ["0.50.34"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-52558", "noindex": false, "published": "2025-06-23T20:52:24.343Z", "modified": "2025-06-24T17:18:38.374Z", "cvss": 7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00594, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-52558", "title": "ChangeDetection.io XSS in watch overview", "description": "changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Prior to version 0.50.4, errors in filters from website page change detection watches were not being filtered resulting in a cross-site scripting (XSS) vulnerability. This issue has been patched in version 0.50.4", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hwpg-x5hw-vpv9", "https://github.com/dgtlmoon/changedetection.io/commit/3d5a544ea674cfce517adcd498877a8d760d0931", "https://nvd.nist.gov/vuln/detail/CVE-2025-52558"], "fixes": ["0.50.4"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-56509", "noindex": false, "published": "2024-12-27T15:56:04.490Z", "modified": "2024-12-27T20:55:14.288Z", "cvss": 8.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "severity": "high", "epss": 0.00715, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-56509", "title": "changedetection.io has Improper Input Validation Leading to LFR/Path Traversal", "description": "changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Improper input validation in the application can allow attackers to perform local file read (LFR) or path traversal attacks. These vulnerabilities occur when user input is used to construct file paths without adequate sanitization or validation. For example, using file:../../../etc/passwd or file: ///etc/passwd can bypass weak validations and allow unauthorized access to sensitive files. Even though this has been addressed in previous patch, it is still insufficient. This vulnerability is fixed in 0.48.05.", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-j5vv-6wjg-cfr8", "https://github.com/dgtlmoon/changedetection.io/commit/f7e9846c9b40a229813d19cdb66bf60fbe5e6a2a", "https://nvd.nist.gov/vuln/detail/CVE-2024-56509"], "fixes": ["0.48.05"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-51998", "noindex": false, "published": "2024-11-07T23:34:07.183Z", "modified": "2024-11-08T15:24:19.464Z", "cvss": 8.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "severity": "high", "epss": 0.00688, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-51998", "title": "Path traversal using file URI scheme without supplying hostname in changedetection.io", "description": "changedetection.io is a free open source web page change detection tool. The validation for the file URI scheme falls short, and results in an attacker being able to read any file on the system. This issue only affects instances with a webdriver enabled, and `ALLOW_FILE_URI` false or not defined. The check used for URL protocol, `is_safe_url`, allows `file:` as a URL scheme. It later checks if local files are permitted, but one of the preconditions for the check is that the URL starts with `file://`. The issue comes with the fact that the file URI scheme is not required to have double slashes. This issue has been addressed in version 0.47.06 ", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-6jrf-rcjf-245r", "https://github.com/dgtlmoon/changedetection.io/commit/49bc982c697169c98b79698889fb9d26f6b3317f", "https://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/model/Watch.py#L11-L13"], "fixes": ["0.47.6"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-51483", "noindex": false, "published": "2024-11-01T16:19:49.670Z", "modified": "2024-11-01T17:30:47.107Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.02293, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-51483", "title": "changedetection.io Path Traversal vulnerability", "description": "changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-cwgg-57xj-g77r", "https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L19", "https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/processors/__init__.py#L35"], "fixes": ["0.47.5"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-34061", "noindex": false, "published": "2024-05-02T13:58:21.939Z", "modified": "2024-08-02T02:42:59.927Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.01281, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-34061", "title": "Reflected cross site scripting in changedetection.io", "description": "changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in parameter notification_urls is not processed resulting in javascript execution in the application. A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content. This issue has been addressed in version 0.45.22. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-pwgc-w4x9-gw67", "https://github.com/dgtlmoon/changedetection.io/commit/c0f000b1d1ce03733460805dbbedde445fe2c762", "https://nvd.nist.gov/vuln/detail/CVE-2024-34061"], "fixes": ["0.45.22"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-32651", "noindex": false, "published": "2024-04-25T23:49:28.540Z", "modified": "2025-02-13T17:52:14.004Z", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.83601, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-32651", "title": "Server Side Template Injection in Jinja2 allows Remote Command Execution", "description": "changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced).", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4r7v-whpg-8rx3", "https://github.com/dgtlmoon/changedetection.io/releases/tag/0.45.21", "https://www.onsecurity.io/blog/server-side-template-injection-with-jinja2"], "fixes": ["0.45.21"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-23329", "noindex": false, "published": "2024-01-19T19:49:54.624Z", "modified": "2024-11-13T17:15:21.418Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00587, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-23329", "title": "changedetection.io API endpoint is not secured with API token", "description": " changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/<uuid>/history` can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "references": ["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hcvp-2cc7-jrwr", "https://github.com/dgtlmoon/changedetection.io/commit/402f1e47e78ecd155b1e90f30cce424ff7763e0f", "https://nvd.nist.gov/vuln/detail/CVE-2024-23329"], "fixes": ["0.45.13"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}, {"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-24769", "noindex": false, "published": "2023-02-17T00:00:00.000Z", "modified": "2025-03-18T15:53:35.859Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00637, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-24769", "title": "CVE-2023-24769", "description": "Changedetection.io before v0.40.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the main page. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter under the \"Add a new change detection watch\" function.", "references": ["https://github.com/dgtlmoon/changedetection.io/issues/1358", "https://www.youtube.com/watch?v=TRTpRlkU3Hc", "https://www.edoardoottavianelli.it/CVE-2023-24769"], "fixes": ["0.40.1.1", "0.40.2"], "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}, {"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}]}], "total": 20, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "changedetection-io", "path": "vulns/pypi/changedetection-io", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-07-14T18:40:38.826Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}