CVE-2026-92814
changedetection.io through 0.60.6 Cross-Site Scripting via watch_title
- State
- Published
- Severity
- 2.3 Low
- Published
- Sep 16, 2026
- Updated
- Sep 17, 2026
- Reserved
- Sep 16, 2026
Description
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watch_title token is used in templates.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.3 Low | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.2 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
changedetection.iodgtlmoon |
|
References
- Researcher write-up, finding 1technical-descriptionexploit
- the escape set omits watch_titletechnical-description
- https://github.com/dgtlmoon/changedetection.ioproduct
- VulnCheck Advisory: changedetection.io through 0.60.6 Cross-Site Scripting via watch_titlethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.