Most recent entries from all

EUVD-2026-260498

fkie_cve-2025-62780

changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in versions prior to 0.50.34 due to insufficient security checks. Two scenarios are possible. In the first, an attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload. In the second, an attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload. When the user clicks on *Preview* and then on the malicious link, the JavaScript malicious code is executed. Version 0.50.34 fixes the issue.

GHSA-4c3j-3h7v-22q9 — changedetection.io: Stored XSS in Watch update via API

Affected: PyPI: changedetection.io

### Summary

A Stored Cross Site Scripting is present in the changedetection.io Watch update API due to unsufficient security checks.

### Details

Tested on changedetection.io version *v0.50.24*

```console REPOSITORY TAG IMAGE ID CREATED SIZE ghcr.io/dgtlmoon/changedetection.io latest 0367276509a0 23 hours ago 599MB ```

When a user tries to add an unsafe URL as a Watch in the changedetection.io UI, the action is blocked with the error message "Watch protocol is not permitted by SAFE_PROTOCOL_REGEX or incorrect URL format". This is catched by the function `validate_url(test_url)`.

```python def validate_url(test_url): # ... from .model.Watch import is_safe_url if not is_safe_url(test_url): # This should be wtforms.validators. raise ValidationError('Watch protocol is not permitted by SAFE_PROTOCOL_REGEX or incorrect URL format') ```

When instead the Watch API is used, this check is not performed resulting in unsafe URLs added as Watch.

### PoC

Update an existing watch with an unsafe URL ```console curl -X PUT "http://example.site/api/v1/watch/1242e1c5-d59e-4352-0078-203a55b21282" \ -H "x-api-key: XXX" \ -H "Content-Type: application/json" \ -d '{ "url": "javascript:alert(document.domain)", "title": "XSS PoC", "paused": false }' ```

### Impact

Two scenarios are possibile:

1. An attacker can insert a new watch with an arbitrary URL which really points to a web page. O…

PYSEC-2025-91

Affected: PyPI: changedetection-io