VulnSocial

CVE-2026-27645Disclosure(webtechnologies / changedetection)

LOWCVSS 6.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. Version 0.54.1 contains a fix for the issue.

webtechnologies CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • changedetection

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-02-25); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
webtechnologies
Products
changedetection

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-02-25: 2Mentions · 2026-03-12: 1Technical Details · 2026-02-25: 2Technical Details · 2026-03-12: 102-2503-12
Signal classification1 categories
Disclosure
3100.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-02-252
Disclosure2
2026-03-121
Disclosure1
Full discourse3 posts
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-27645 - medium 🚨 http://Changedetection.io RSS Single Watch - Cross-Site Scripting > http://changedetection.io < 0.54.1 contains a stored XSS caused by unescaped reflection of U... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-27645 @pdnuclei #NucleiTemplates #cve

    Post summary

    The post announces CVE‑2026‑27645, a medium‑severity stored XSS in Changedetection.io ≤05.0.1, and links to external resources but offers no PoC or mitigation details.

    00001123
    902 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-27645 Cross-Site Scripting in http://changedetection.io RSS Endpoint Prior to 0.54.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27645

    Post summary

    A Cross‑Site Scripting vulnerability (CVE‑2026‑27645) was disclosed for changedetection.io RSS endpoint versions prior to 0.54.1, with no PoC, exploit, or patch details provided.

    0000046
    4.0K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-27645 http://changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter d… https://www.cve.org/CVERecord?id=CVE-2026-27645

    Post summary

    The post references CVE-2026-27645, noting a reflected UUID parameter in the RSS single‑watch endpoint of changedetection.io before version 0.54.1, but does not mention PoC, exploit, patch, or active exploitation.

    0000097
    56.6K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appwebtechnologieschangedetection---

Explore more

Back to dashboardwebtechnologies CVEschangedetection vulnerabilities