Webtechnologies

Changedetection

10 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.8

CVE-2026-35490

Exploit
  • EPSS 0.02%
  • Veröffentlicht 07.04.2026 14:55:24
  • Zuletzt bearbeitet 14.04.2026 20:27:38

changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login_optionally_required decorator is placed before (outer to) @blueprint.route() instead of after it. In Flask, @route() must be the outermost decorator ...

6.5

CVE-2026-33981

Exploit
  • EPSS 0.01%
  • Veröffentlicht 27.03.2026 22:01:13
  • Zuletzt bearbeitet 02.04.2026 15:24:05

changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the `jq:` and `jqraw:` include filter expressions allow use of the jq `env` builtin, which reads all process environment variables and stores them as the watch ...

9.1

CVE-2026-29065

Exploit
  • EPSS 0.08%
  • Veröffentlicht 06.03.2026 07:16:02
  • Zuletzt bearbeitet 10.03.2026 20:00:57

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerability in the backup restore functionality allows arbitrary file overwrite via path traversal in uploaded ZIP archives. This issue has...

6.1

CVE-2026-29038

Exploit
  • EPSS 0.04%
  • Veröffentlicht 06.03.2026 07:16:01
  • Zuletzt bearbeitet 10.03.2026 19:38:06

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected cross-site scripting (XSS) vulnerability identified in the /rss/tag/ endpoint of changedetection.io. The tag_uuid path parameter is...

7.5

CVE-2026-29039

Exploit
  • EPSS 0.01%
  • Veröffentlicht 06.03.2026 07:16:01
  • Zuletzt bearbeitet 10.03.2026 19:37:32

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, the changedetection.io application allows users to specify XPath expressions as content filters via the include_filters field. These XPath expressions a...

8.6

CVE-2026-27696

Exploit
  • EPSS 0.02%
  • Veröffentlicht 25.02.2026 04:16:22
  • Zuletzt bearbeitet 26.02.2026 15:34:26

changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, changedetection.io is vulnerable to Server-Side Request Forgery (SSRF) because the URL validation function `is_safe_valid_url()` does not validate t...

6.1

CVE-2026-27645

Exploit
  • EPSS 0.8%
  • Veröffentlicht 25.02.2026 04:06:58
  • Zuletzt bearbeitet 25.02.2026 16:51:33

changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/ht...

5.3

CVE-2026-25527

Exploit
  • EPSS 0.1%
  • Veröffentlicht 19.02.2026 14:18:18
  • Zuletzt bearbeitet 19.02.2026 19:54:04

changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` route accepts `group=".."`, which causes `send_from_directory("static/..", filename)` to execute. This moves the ba...

3.7

CVE-2024-23329

Exploit
  • EPSS 0.45%
  • Veröffentlicht 19.01.2024 20:15:13
  • Zuletzt bearbeitet 19.02.2026 17:44:46

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/<uuid>/history` can be accessed by any unauthorized user. As a result any unauthorized user can check on...

5.4

CVE-2023-24769

Exploit
  • EPSS 0.75%
  • Veröffentlicht 17.02.2023 22:15:14
  • Zuletzt bearbeitet 19.02.2026 17:44:46

Changedetection.io before v0.40.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the main page. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL...