Threats tagged 'ghsa-99x5-c87r-97w2'

changedetection.io versions up to 0.60.6 contain a cross-site scripting (XSS) vulnerability due to improper escaping of scraped page titles in HTML notifications. This allows attackers to inject arbitrary markup into notification channels such as email and Telegram when the watch_title token is used in templates. The vulnerability has a low severity score and no known exploits in the wild.