Every CVE Search/ Get API key

CVE-2016-10134

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers...

9.8 CriticalPublic exploitFix available

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

82.6%Up 25.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.

Record
CVE-2016-10134
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-89
Updated
2026-11-02
CVE List No score

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.

Record
CVE-2016-10134
Updated
2026-11-02
EUVDEUVD-2016-1323 No score

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.

Record
EUVD-2016-1323
Updated
2026-11-03
GitHub AdvisoriesGHSA-q33m-pmcq-844x 9.8

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers...

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.

Record
GHSA-q33m-pmcq-844x
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
OSVALPINE-CVE-2016-10134 9.8

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.

Record
ALPINE-CVE-2016-10134
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 9.8

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.

Record
CVE-2016-10134
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-10134 9.8

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.

Record
DEBIAN-CVE-2016-10134
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2016-10134 9.8

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.

Record
UBUNTU-CVE-2016-10134
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUSN-4767-1 No score

zabbix vulnerabilities

Fu Chuang discovered that Zabbix did not properly parse IPs. A remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2020-11800)

It was discovered that Zabbix incorrectly handled certain requests. A remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2017-2824, CVE-2017-2825)

It was discovered that Zabbix incorrectly handled certain XML files. A remote attacker could possibly use this issue to read arbitrary files or potentially execute arbitrary code. This issue only affected Ubuntu 14.04 ESM. (CVE-2014-3005)

It was discovered that Zabbix incorrectly handled certain inputs. A remote attacker could possibly use this issue to execute arbitrary SQL commands. This issue only affected Ubuntu 14.04 ESM. (CVE-2016-10134, CVE-2016-4338)

It was discovered that Zabbix incorrectly handled the request parameter. A remote attacker could possibly use this issue to redirect requests to external links. This issue only affected Ubuntu 14.04 ESM and Ubuntu 18.04 ESM. (CVE-2016-10742)

It was discovered that Zabbix incorrectly handled failed login attempts. A remote attacker could possibly use this issue to enumerate users. (CVE-2019-15132)

It was discovered that Zabbix did not properly validate input. A remote attacker could exploit this to conduct cross-site scripting (XSS) attacks. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-15803)

Record
USN-4767-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
zabbix
Alpine:v3.10
 before 3.0.4-r0
3.0.4-r0
zabbix
Alpine:v3.5
 before 3.0.4-r0
3.0.4-r0
zabbix
Debian:12
 before 1:3.0.4+dfsg-1
1:3.0.4+dfsg-1
zabbix
Debian:13
 before 1:3.0.4+dfsg-1
1:3.0.4+dfsg-1
zabbix
Debian:14
 before 1:3.0.4+dfsg-1
1:3.0.4+dfsg-1
zabbix
Debian:8
 before 1:2.2.7+dfsg-2+deb8u2, plus listed versions
1:2.2.7+dfsg-21:2.2.7+dfsg-2+deb8u1
1:2.2.7+dfsg-2+deb8u2
zabbix
Ubuntu:Pro:14.04:LTS
 before 1:2.2.2+dfsg-1ubuntu1+esm1, plus listed versions
1:2.0.6+dfsg-1ubuntu21:2.2.0+dfsg-1ubuntu11:2.2.0+dfsg-6ubuntu11:2.2.1+dfsg-1ubuntu31:2.2.2+dfsg-1ubuntu1
1:2.2.2+dfsg-1ubuntu1+esm1
zabbix
Ubuntu:Pro:14.04:LTS
From an advisory covering 9 CVEs
 before 1:2.2.2+dfsg-1ubuntu1+esm4, plus listed versions
1:2.0.6+dfsg-1ubuntu21:2.2.0+dfsg-1ubuntu11:2.2.0+dfsg-6ubuntu11:2.2.1+dfsg-1ubuntu31:2.2.2+dfsg-1ubuntu11:2.2.2+dfsg-1ubuntu1+esm11:2.2.2+dfsg-1ubuntu1+esm3
1:2.2.2+dfsg-1ubuntu1+esm4
zabbix
Ubuntu:Pro:16.04:LTS
From an advisory covering 9 CVEs
 before 1:2.4.7+dfsg-2ubuntu2.1+esm3, plus listed versions
1:2.4.6+dfsg-11:2.4.7+dfsg-11:2.4.7+dfsg-21:2.4.7+dfsg-2ubuntu21:2.4.7+dfsg-2ubuntu2.11:2.4.7+dfsg-2ubuntu2.1+esm11:2.4.7+dfsg-2ubuntu2.1+esm2
1:2.4.7+dfsg-2ubuntu2.1+esm3
zabbix
Ubuntu:Pro:18.04:LTS
From an advisory covering 9 CVEs
 before 1:3.0.12+dfsg-1ubuntu0.1~esm3, plus listed versions
1:3.0.7+dfsg-31:3.0.12+dfsg-11:3.0.12+dfsg-1ubuntu0.1~esm11:3.0.12+dfsg-1ubuntu0.1~esm2
1:3.0.12+dfsg-1ubuntu0.1~esm3
zabbix
Ubuntu:Pro:20.04:LTS
From an advisory covering 9 CVEs
 before 1:4.0.17+dfsg-1ubuntu0.1~esm1, plus listed versions
1:4.0.4+dfsg-1build21:4.0.4+dfsg-1build31:4.0.11+dfsg-11:4.0.14+dfsg-11:4.0.15+dfsg-11:4.0.16+dfsg-11:4.0.16+dfsg-1build11:4.0.17+dfsg-1
1:4.0.17+dfsg-1ubuntu0.1~esm1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubCyberCTF/vulhub-zabbix-cve-2016-101342026-10-08
MetasploitZabbix toggle_ids SQL Injection2016-08-11
NucleiZabbix - SQL Injection

History

History
RecordedChangedSources
affected, facts
affected, exploitsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-10134 is a critical vulnerability (CVSS 9.8) in Zabbix, published February 16, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 82.6%, the 99th percentile. Fixed in zabbix 3.0.4-r0.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open