| Package | Affected versions | Patched versions |
|---|---|---|
| changedetection-io | < 0.45.22 | 0.45.22 |
Input in parameter notification_urls is not processed resulting in javascript execution in the application
changedetection.io version: v0.45.21
https://github.com/dgtlmoon/changedetection.io/blob/0.45.21/changedetectionio/forms.py#L226
for server_url in field.data:
if not apobj.add(server_url):
message = field.gettext('\'%s\' is not a valid AppRise URL.' % (server_url))
raise ValidationError(message)
Setting > ADD Notification URL List
"><img src=x onerror=alert(document.domain)>
Requests
A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free