3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62780

CVE-2025-62780: changedetection.io vulnerable to stored XSS in Watch update via API

changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in versions prior to 0.50.34 due to insufficient security checks. Two scenarios are possible. In the first, an attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload. In the second, an attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload. When the user clicks on Preview and then on the malicious link, the JavaScript malicious code is executed. Version 0.50.34 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62780

CVE-2025-62780:

3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
changedetection.io	pip	< 0.50.34	0.50.34

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue within the changedetection.io application, specifically in the API endpoints for managing watches. The root cause was the insufficient validation of the url parameter when creating or updating a watch via the API.

The advisory's Proof of Concept demonstrates that an attacker with API access could send a PUT request to /api/v1/watch/{uuid} to update a watch's URL to a malicious javascript: payload. The analysis of the patch commits confirms this. The primary vulnerable function was Watch.put in changedetectionio/api/Watch.py, which completely lacked URL validation for incoming updates.

The patch, introduced in commit 552e98519b2811c2e25000f1ff0995715aa0b725, adds a call to a new is_safe_url function to validate the URL before applying the update. This function explicitly checks if the URL starts with a safe protocol (http, https, ftp, file).

Further investigation of subsequent commits, like d48c82052a7b9bbff65ea65d38d5b8a67a3ab03b, revealed that the Watch.post method (for creating watches) was also inadequately protected. It used a generic validators.url check which was replaced by the more robust, custom validation logic. This implies that both creating and updating watches through the API were vulnerable entry points. When a user later views or previews the watch with the malicious URL in the web UI, the JavaScript payload executes in their browser.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.