Skip to content
Heist/ feed
Back to feed
Medium

Reflected cross site scripting in changedetection.io

Type: advisorySources: OSV

changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in parameter notification_urls is not processed resulting in javascript execution in the application. A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content. This issue has been addressed in version 0.45.22. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2024-34061
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 17:08 UTC · Revision 1

Source evidence

Reflected cross site scripting in changedetection.io

core-osv · Original source

Published 2 May 2024, 13:58 UTC

changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in parameter notification_urls is not processed resulting in javascript execution in the application. A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content. This issue has been addressed in version 0.45.22. Users are advised to upgrade. There are no known workarounds for this vulnerability.

osv:CVE-2024-34061
Complete source record
{
  "id": "0edc0ae6be8de5e60233809a4bbf76d0edfc55f14ce734ecb23eb43bc1ee93b6",
  "url": "https://osv.dev/vulnerability/CVE-2024-34061",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Reflected cross site scripting in changedetection.io",
    "summary": "changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in parameter notification_urls is not processed resulting in javascript execution in the application. A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content. This issue has been addressed in version 0.45.22. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
    "evidence": "osv:CVE-2024-34061",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2024-34061",
      "aliases": [
        "CVE-2024-34061",
        "GHSA-pwgc-w4x9-gw67",
        "PYSEC-2026-1243"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/dgtlmoon/changedetection.io",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "d127214d8f3f947e02bf65d48cd1663ebbe897df"
                },
                {
                  "fixed": "c0f000b1d1ce03733460805dbbedde445fe2c762"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.45.22"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "c0f000b1d1ce03733460805dbbedde445fe2c762"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "0.45.21",
            "0.45.20",
            "0.45.19",
            "0.45.18",
            "0.45.17",
            "0.45.16",
            "0.45.15",
            "0.45.14",
            "0.45.13",
            "0.45.12",
            "0.45.10",
            "0.45.9",
            "0.45.8.1",
            "0.45.8",
            "0.45.7.3",
            "0.45.7.2",
            "0.45.7.1",
            "0.45.7",
            "0.45.6",
            "0.45.5",
            "0.45.4",
            "0.45.3",
            "0.45.2",
            "0.45.1",
            "0.45",
            "0.44.2",
            "0.44.1",
            "0.44",
            "0.43.2",
            "0.43.1",
            "0.43",
            "0.42.3",
            "0.42.2",
            "0.42.1",
            "0.42",
            "0.41.1",
            "0.41",
            "0.40.3",
            "0.40.2",
            "0.40.1.1",
            "0.40.1.0",
            "0.40.0.4",
            "0.40.0.3",
            "0.40.0.2",
            "0.40.0",
            "0.39.22.1",
            "0.39.22",
            "0.39.21.1",
            "0.39.21",
            "0.39.20.4",
            "0.39.20.3",
            "0.39.20.2",
            "0.39.20.1",
            "0.39.20",
            "0.39.19.1",
            "0.39.19",
            "0.39.18",
            "0.39.17.2",
            "0.39.17.1",
            "0.39.17",
            "0.39.16",
            "0.39.15",
            "0.39.14",
            "0.39.13.1",
            "0.39.13",
            "0.39.12",
            "0.39.11",
            "0.39.10",
            "0.39.9",
            "0.39.8",
            "0.39.7",
            "0.39.6",
            "0.39.5",
            "0.39.4",
            "0.39.3",
            "0.39.2",
            "0.39.1",
            "0.39",
            "0.38.2",
            "0.38.1",
            "0.38",
            "0.37",
            "0.35",
            "0.34",
            "0.33",
            "0.32",
            "0.31",
            "0.30",
            "0.29",
            "0.28",
            "0.27",
            "0.26",
            "0.25",
            "0.24",
            "0.23",
            "0.22",
            "0.21",
            "0.2",
            "0.12",
            "0.11",
            "0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-34061.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:37.891669173Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34061.json",
        "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-pwgc-w4x9-gw67",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-34061",
        "https://github.com/dgtlmoon/changedetection.io/commit/c0f000b1d1ce03733460805dbbedde445fe2c762"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-79"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34061.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-34061",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 505164,
  "published_at": "2024-05-02T13:58:21.939+00:00"
}