PT-2025-46200 · Unknown · Changedetection.Io

Edoardottt · Published 2025-11-10 · Updated 2026-02-25 · CVE-2025-62780

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions changedetection.io versions prior to 0.50.34

Description A Stored Cross Site Scripting issue exists in changedetection.io’s Watch update API due to inadequate security checks. An attacker can insert a new watch with a URL pointing to a web page, then modify the URL to include a JavaScript payload. Alternatively, an attacker can replace the URL in an existing watch with a JavaScript payload. When a user previews the malicious link, the JavaScript code is executed. This impacts the application's ability to securely handle user-provided URLs.

Recommendations Update to version 0.50.34 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62780

GHSA-4C3J-3H7V-22Q9

PYSEC-2025-91

Affected Products

Changedetection.Io

References · 14

• 🔥 https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4c3j-3h7v-22q9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62780.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-62780 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-91 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4c3j-3h7v-22q9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62780 · Security Note
• https://github.com/dgtlmoon/changedetection.io · Note
• https://github.com/dgtlmoon/changedetection.io/pull/3564 · Note
• https://github.com/dgtlmoon/changedetection.io/releases/tag/0.50.34 · Note
• https://github.com/dgtlmoon/changedetection.io/issues/3562 · Note
• https://twitter.com/pdnuclei_bot/status/2026492380304781604 · Twitter Post
• https://t.me/cveNotify/147377 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1ow3bmx/resumen_diario_de_vulnerabilidades_13112025 · Reddit Post
• https://twitter.com/CVEnew/status/1987999629938438347 · Twitter Post