CVE-2025-62780: changedetection.io vulnerable to stored XSS in Watch update via API

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-11-10 · updated 2026-06-17
Weakness: CWE-79

Description

changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in versions prior to 0.50.34 due to insufficient security checks. Two scenarios are possible. In the first, an attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload. In the second, an attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload. When the user clicks on *Preview* and then on the malicious link, the JavaScript malicious code is executed. Version 0.50.34 fixes the issue.

Affected products

Changedetection: before 0.50.34 — fixed in 0.50.34

How to fix

Upgrade to a fixed version: Changedetection 0.50.34. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-62780 or the next vulnerability affects your stack