changedetection.io: Stored XSS in Watch update via API

Summary A Stored Cross Site Scripting is present in the changedetection.io Watch update API due to unsufficient security checks. Details Tested on changedetection.io version v0.50.24 console REPOSITORY TAG IMAGE ID CREATED SIZE ghcr.io/dgtlmoon/changedetection.io latest 0367276509a0 23 hours ago...

EUVD-2025-50820

changedetection.io: Stored XSS in Watch update via API...

Malicious code in polymer-io-sgdahsdi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecbc40711336e7d840192390a12d5b7624731b6409fe433ea79121bcb481211c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-137503

Malicious code in polymer-io-sgdahsdi npm...

EUVD-2025-122593

Malicious code in resolvers-karma-leda-io npm...

EUVD-2025-124174

Malicious code in oberon-io-thuban-draco npm...

EUVD-2025-124715

Malicious code in mui-io-jupiter-passport npm...

EUVD-2025-112415

Malicious code in io-geckodriver-local-publish npm...

EUVD-2025-111885

Malicious code in kronos-spinner-io-jekyll npm...

EUVD-2025-123418

Malicious code in prettier-soap-io-hermes npm...

EUVD-2025-112417

Malicious code in io-frontend-jasmine-ursa npm...

EUVD-2025-112405

Malicious code in io-version-spinner-eclipse npm...

EUVD-2025-112418

Malicious code in io-eslint-plugin-yonder-unuk npm...

EUVD-2025-123034

Malicious code in pyxis-quark-io-request npm...

EUVD-2025-111406

Malicious code in markdown-pdf-umbriel-jekyll-io npm...

EUVD-2025-122582

Malicious code in rest-arcturus-io-spinner npm...

EUVD-2025-120237

Malicious code in xenos-weywot-yonder-io npm...

EUVD-2025-112406

Malicious code in io-unuk-pegasus-concurrently npm...

Malicious code in io-cache-webdriverio-carina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ab5ad4ee1784e75ef77e20efddc0f5f115f497559dcceb0c977e7ebe008c054 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ariel-io-callisto-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e34a4a273f70ddab96ef9dba67cc8c2ea71e655a6a12b591757054a7ccab894 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...