Advisories · Technology
dgtlmoon Changedetection.io.
Every CVE that names dgtlmoon Changedetection.io among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.1 Medium
dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting
- dgtlmoon Changedetection.io
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.9 Medium
dgtlmoon changedetection.io Preview Endpoint __init__.py add_watch_ui_snapshot server-side request forgery
- dgtlmoon changedetection.io
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
dgtlmoon changedetection.io visual_selector_data flask_app.py static_content path traversal
- dgtlmoon changedetection.io
- Path traversal
- CVSS 6.3 Medium
dgtlmoon changedetection.io Screenshot flask_app.py static_content path traversal
- dgtlmoon changedetection.io
- Path traversal
- CVSS 6.9 Medium
dgtlmoon changedetection.io Authentication Hook flask_app.py check_authentication improper authentication
- dgtlmoon changedetection.io
- Authentication bypass
- CVSS 6.3 Medium
dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancy
- dgtlmoon changedetection.io
- Information disclosure
- CWE-208
- CVSS 8.7 High
changedetection.io through 0.60.6 SSRF via browser-step Goto URL
- dgtlmoon changedetection.io
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
changedetection.io through 0.60.6 Cross-Site Scripting via watch_title
- dgtlmoon changedetection.io
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force
- dgtlmoon changedetection.io
- Authentication bypass
- CVSS 6.3 Medium
changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement
- dgtlmoon changedetection.io
- Broken access control
- CVSS 5.3 Medium
changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema
- dgtlmoon changedetection.io
- Authentication bypass