« Volver al listado

CVE-2026-95657

Estado: AplazadaBaja (2)—

A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.60.1 is capable of addressing this issue. This patch is called aac6fcfa594f17511b8ff73e5eaa4f6c33899de0. It is suggested to upgrade the affected component.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XSS en Visual Selector (CWE-79) con vector AV:N permite inyección de script remota. Manipulación del argumento 's' en setCurrentSelectedText ejecuta código JavaScript en contexto del navegador (T1059.007).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based ContentUser TrainingExecution PreventionBehavior Prevention on EndpointEncrypt Sensitive InformationDisable or Remove Feature or Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Dgtlmoon — Changedetection.ioAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-95657",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-95657",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-25T23:53:22.036842Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.5,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.1
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 2,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cna@vuldb.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:dgtlmoon:changedetection.io:*:*:*:*:*:*:*:*"
          ],
          "vendor": "dgtlmoon",
          "modules": [
            "Visual Selector"
          ],
          "product": "Changedetection.io",
          "versions": [
            {
              "status": "affected",
              "version": "0.55.0"
            },
            {
              "status": "affected",
              "version": "0.55.1"
            },
            {
              "status": "affected",
              "version": "0.55.2"
            },
            {
              "status": "affected",
              "version": "0.55.3"
            },
            {
              "status": "affected",
              "version": "0.55.4"
            },
            {
              "status": "affected",
              "version": "0.55.5"
            },
            {
              "status": "affected",
              "version": "0.55.6"
            },
            {
              "status": "affected",
              "version": "0.55.7"
            },
            {
              "status": "affected",
              "version": "0.55.8"
            },
            {
              "status": "unaffected",
              "version": "0.60.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-09-22T18:17:37.550",
  "references": [
    {
      "url": "https://github.com/dgtlmoon/changedetection.io/",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/dgtlmoon/changedetection.io/commit/aac6fcfa594f17511b8ff73e5eaa4f6c33899de0",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/dgtlmoon/changedetection.io/pull/4282",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/dgtlmoon/changedetection.io/releases/tag/0.60.1",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/herantong/cve/blob/main/changedetection.io_xss-visual-selector_CWE-79",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/cve/CVE-2026-95657",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/submit/896587",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/408413",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/408413/cti",
      "source": "cna@vuldb.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@vuldb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.60.1 is capable of addressing this issue. This patch is called aac6fcfa594f17511b8ff73e5eaa4f6c33899de0. It is suggested to upgrade the affected component."
    }
  ],
  "lastModified": "2026-09-26T00:16:38.720",
  "sourceIdentifier": "cna@vuldb.com"
}