ChangeDetection.io <= v0.50.33 - Stored XSS via Watch API
CVE-2025-62780
Verified
Description
changedetection.io <= 0.50.34 contains a stored cross site scripting caused by insufficient security checks in the Watch update API, letting attackers execute arbitrary JavaScript when users preview malicious links, exploit requires user interaction
Severity
Medium
CVSS Score
6.2
Exploit Probability
0%
Published Date
February 23, 2026
Template Author
0x_akoko
CVE-2025-62780.yaml
6.2Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
CVE ID:
cve-2025-62780
CWE ID:
cwe-79
Remediation Steps
Update to version 0.50.34 or later.