Close Menu
    DevStackTipsDevStackTips
    • Home
    • News & Updates
      1. Tech & Work
      2. View All

      CodeSOD: One Last ID

      September 24, 2025

      9 Ways AI Code Generation in React.js Reduces Technical Debt for Product Teams

      September 24, 2025

      GitHub details upcoming changes to improve security in wake of Shai-Hulud worm in npm ecosystem

      September 24, 2025

      Syncfusion restructures Essential Studio into multiple different suites to provide greater flexibility for developers

      September 24, 2025

      Distribution Release: Kali Linux 2025.3

      September 23, 2025

      Distribution Release: SysLinuxOS 13

      September 23, 2025

      Development Release: MX Linux 25 Beta 1

      September 22, 2025

      DistroWatch Weekly, Issue 1140

      September 21, 2025
    • Development
      1. Algorithms & Data Structures
      2. Artificial Intelligence
      3. Back-End Development
      4. Databases
      5. Front-End Development
      6. Libraries & Frameworks
      7. Machine Learning
      8. Security
      9. Software Engineering
      10. Tools & IDEs
      11. Web Design
      12. Web Development
      13. Web Security
      14. Programming Languages
        • PHP
        • JavaScript
      Featured

      A Stream-Oriented UI library for interactive web applications

      September 24, 2025
      Recent

      A Stream-Oriented UI library for interactive web applications

      September 24, 2025

      billboard.js 3.17.0: ✨ New Axis Customization, Label Styling & Image Labels!

      September 24, 2025

      AEM and Cloudflare Workers: The Ultimate Duo for Blazing Fast Pages

      September 24, 2025
    • Operating Systems
      1. Windows
      2. Linux
      3. macOS
      Featured

      Distribution Release: Kali Linux 2025.3

      September 23, 2025
      Recent

      Distribution Release: Kali Linux 2025.3

      September 23, 2025

      Distribution Release: SysLinuxOS 13

      September 23, 2025

      How I Configure Polybar to Customize My Linux Desktop

      September 23, 2025
    • Learning Resources
      • Books
      • Cheatsheets
      • Tutorials & Guides
    Home»Security»Common Vulnerabilities and Exposures (CVEs)»CVE-2025-52558 – changedetection.io Cross-Site Scripting (XSS)

    CVE-2025-52558 – changedetection.io Cross-Site Scripting (XSS)

    June 23, 2025

    CVE ID : CVE-2025-52558

    Published : June 23, 2025, 9:15 p.m. | 4 hours, 46 minutes ago

    Description : changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Prior to version 0.50.4, errors in filters from website page change detection watches were not being filtered resulting in a cross-site scripting (XSS) vulnerability. This issue has been patched in version 0.50.4

    Severity: 0.0 | NA

    Visit the link for more details, such as CVSS details, affected products, timeline, and more…

    Source: Read More

    Facebook Twitter Reddit Email Copy Link
    Previous ArticleCVE-2025-52561 – HTMLSanitizer.jl SVG Tag Injection Vulnerability
    Next Article CVE-2025-23092 – Mitel OpenScape Accounting Path Traversal Vulnerability

    Related Posts

    Development

    Cursor AI Code Editor Flaw Enables Silent Code Execution via Malicious Repositories

    September 14, 2025
    Development

    Introducing HybridPetya: Petya/NotPetya copycat with UEFI Secure Boot bypass

    September 14, 2025
    Leave A Reply Cancel Reply

    For security, use of Google's reCAPTCHA service is required which is subject to the Google Privacy Policy and Terms of Use.

    Continue Reading

    Microsoft shareholders call for review of ties to Israel — “In the face of serious allegations of complicity in genocide and other international crimes, Microsoft’s HRDD processes appear ineffective”

    News & Updates

    How to Use the View Transition API for Better Web Transitions

    Development

    libpeer is a portable WebRTC library for IoT/embedded devices

    Linux

    CVE-2025-48139 – StyleAI Missing Authorization Vulnerability

    Common Vulnerabilities and Exposures (CVEs)

    Highlights

    CVE-2025-46720 – Keystone Node.js Oracle Filter Bypass

    May 5, 2025

    CVE ID : CVE-2025-46720

    Published : May 5, 2025, 7:15 p.m. | 18 minutes ago

    Description : Keystone is a content management system for Node.js. Prior to version 6.5.0, `{field}.isFilterable` access control can be bypassed in `update` and `delete` mutations by adding additional unique filters. These filters can be used as an oracle to probe the existence or value of otherwise unreadable fields. Specifically, when a mutation includes a `where` clause with multiple unique filters (e.g. `id` and `email`), Keystone will attempt to match records even if filtering by the latter fields would normally be rejected by `field.isFilterable` or `list.defaultIsFilterable`. This can allow malicious actors to infer the presence of a particular field value when a filter is successful in returning a result. This affects any project relying on the default or dynamic `isFilterable` behavior (at the list or field level) to prevent external users from using the filtering of fields as a discovery mechanism. While this access control is respected during `findMany` operations, it was not completely enforced during `update` and `delete` mutations when accepting more than one unique `where` values in filters. This has no impact on projects using `isFilterable: false` or `defaultIsFilterable: false` for sensitive fields, or for those who have otherwise omitted filtering by these fields from their GraphQL schema. This issue has been patched in `@keystone-6/core` version 6.5.0. To mitigate this issue in older versions where patching is not a viable pathway, set `isFilterable: false` statically for relevant fields to prevent filtering by them earlier in the access control pipeline (that is, don’t use functions); set `{field}.graphql.omit.read: true` for relevant fields, which implicitly removes filtering by these fields from the GraphQL schema; and/or deny `update` and `delete` operations for the relevant lists completely.

    Severity: 3.1 | LOW

    Visit the link for more details, such as CVSS details, affected products, timeline, and more…

    Why Designers Get Stuck In The Details And How To Stop

    June 3, 2025

    China’s Massistant Tool Secretly Extracts SMS, GPS Data, and Images From Confiscated Phones

    July 18, 2025

    AI-Driven Human Hacking is a New Frontier in Cybersecurity

    April 16, 2025
    © DevStackTips 2025. All rights reserved.
    • Contact
    • Privacy Policy

    Type above and press Enter to search. Press Esc to cancel.