medium·Web Vulnerabilities·Updated Mar 12, 2026

Changedetection.io RSS Single Watch - Cross-Site Scripting

Run This Scanner →

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsurl

CostFree

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

CVECVE-2026-27645

6.1

CVSSmedium

Exploitable remotely over the internet · no authentication required · user interaction needed.

Description

changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. Version 0.54.1 contains a fix for the issue.

Attack Vector

Network

Privileges Req.

None

User Interaction

Required

Affected

changedetection.ioby dgtlmoon

< 0.54.1

Updated Sep 18, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Run This Scanner →Browse All Tools

Changedetection.io RSS Single Watch - Cross-Site Scripting

Check your infrastructure.Right now.

Check your infrastructure.
Right now.