CVE-2024-51483Medium· 6.5▾ TwilightPoC availablechangedetection.io Path Traversal
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
2.3%
Nuclei ×1
When a WebDriver is used to fetch files source:file:///etc/passwd can be used to retrieve local system files, where the more traditional file:///etc/passwd gets blocked
The root cause is the payload source:file:///etc/passwdpasses the regex here and also passes the check here where a traditional file:///etc/passwd would get blocked
CL-ChangeDetection.io Path Travsersal-311024-181039.pdf
It depends on where the webdriver is deployed but generally this is a high impact vulnerability
changedetection-io < 0.47.5Upgrade to a patched release:
changedetection-io 0.47.5Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-32651Critical· 10.0changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
CVE-2026-27645Medium· 6.1changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
CVE-2024-34061Medium· 4.3changedetection.io Cross-site Scripting vulnerability
CVE-2024-23329Low· 3.7changedetection.io API endpoint is not secured with API token
CVE-2026-29038Medium· 6.1changedetection.io has Reflected XSS in its RSS Tag Error Response
CVE-2026-29039Highchangedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()