CVE-2026-33981

A vulnerability in Changedetection.io up to 0.55.8. The function setCurrentSelectedText in visual-selector.js is affected. Manipulating the argument s can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed. Upgrading to version 0.60.1 addresses the issue. The patch is aac6fcfa594f17511b8ff73e5eaa4f6c33899de0.

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07, affecting the function add_watch_ui_snapshot in changedetectionio/blueprint/add_watch_ui/__init__.py of the Preview Endpoint component. Manipulation of the url argument results in server-side request forgery (SSRF), and the attack can be initiated remotely. The exploit has been made public and could be used; upgrading to version 0.60.1 resolves the issue (patch 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e).

A path traversal vulnerability was found in changedetection.io up to version 0.60.7, affecting the static_content function in changedetectionio/flask_app.py within the visual_selector_data component. Manipulating the filename argument allows remote exploitation. The exploit has been publicly disclosed and may be used by attackers.

changedetection.io up to version 0.60.7 has a path traversal vulnerability in the static_content function in changedetectionio/flask_app.py in the Screenshot Handler component. Manipulating the filename argument allows a remote attack with high complexity and difficult exploitability. The exploit has been published, but the vendor did not respond.

A vulnerability was found in changedetection.io up to 0.60.7 in the check_authentication function of changedetectionio/flask_app.py within the Authentication Hook component. Improper validation leads to improper authentication, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used; the vendor did not respond to the disclosure.

changedetection.io up to version 0.60.7 has a vulnerability involving an observable timing discrepancy in the check_password function in changedetectionio/flask_app.py in the Hash Comparison component. The attack can be performed remotely, requires high complexity, and is difficult to exploit. The exploit has been published, and the vendor did not respond.

changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optional_value parameter to retrieve responses from restricted network locations.

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watch_title token is used in templates.

changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).

In changedetection.io, the /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.