CVE Feed

    Dashboard / CVE / CVE-2026-95657

    CVE-2026-95657

    A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.60.1 is capable of addressing this issue. This patch is called aac6fcfa594f17511b8ff73e5eaa4f6c33899de0. It is suggested to upgrade the affected component.

    Published:Sep 22, 2026
    Last Modified:Sep 26, 2026
    EPS:Sep 22, 2026
    EPSS Score:0.00416
    CVSS Score:3.5

    Affected Products

    Vendor
    Dgtlmoon
    Product
    Changedetection.io

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-95656 (CVSS 5.5) — A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the functi…
    CVE-2026-95273 (CVSS 2.1) — A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_c…
    CVE-2026-95272 (CVSS 2.9) — A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function static_conten…
    CVE-2026-95271 (CVSS 5.5) — A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is the functi…
    CVE-2026-95270 (CVSS 2.9) — A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_…
    CVE-2026-92815 (CVSS 8.7) — changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthentic…
    CVE-2026-92814 (CVSS 2.3) — changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbit…
    CVE-2026-71205 (CVSS 6.5) — changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with …
    CVE-2026-71204 (CVSS 6.2) — changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merg…
    CVE-2026-71203 (CVSS 5.3) — changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller'…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High