{"cve":"CVE-2025-62780","nvd":{"published":"2025-11-10T22:15:36.200","modified":"2026-06-17T09:52:25.393","status":"Analyzed","description":"changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in versions prior to 0.50.34 due to insufficient security checks. Two scenarios are possible. In the first, an attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload. In the second, an attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload. When the user clicks on *Preview* and then on the malicious link, the JavaScript malicious code is executed. Version 0.50.34 fixes the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4},"cwes":["CWE-79"],"references":["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4c3j-3h7v-22q9","https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4c3j-3h7v-22q9"],"products":["changedetection:changedetection"],"source":"nvd","synced_at":"2026-10-19T22:14:53.307938015+00:00"},"epss":{"cve":"CVE-2025-62780","score":0.00462,"percentile":0.40074,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-4c3j-3h7v-22q9","url":"https://osv.dev/vulnerability/GHSA-4c3j-3h7v-22q9","summary":"changedetection.io: Stored XSS in Watch update via API","modified":"2026-06-05T14:30:14.151541624Z","packages":[{"ecosystem":"PyPI","name":"changedetection-io","purl":"pkg:pypi/changedetection-io","ranges":["<0.50.34"],"fixed":["0.50.34"]}]},{"id":"PYSEC-2025-91","url":"https://osv.dev/vulnerability/PYSEC-2025-91","summary":"","modified":"2026-05-20T09:18:54.298759Z","packages":[{"ecosystem":"PyPI","name":"changedetection-io","purl":"pkg:pypi/changedetection-io","ranges":["<0.50.34"],"fixed":["0.50.34"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}