CVE-2019-8423

ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query]...

9.8 CriticalFix available

CVE-2019-8423 is a critical vulnerability (CVSS 9.8) in Zoneminder, published February 18, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.61%, the 76th percentile. Fixed in zoneminder 1.36.7-r0.

ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.61%Up 1.0 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.

Record: CVE-2019-8423
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-89
Updated: 2026-11-02

CVE List No score

ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.

Record: CVE-2019-8423
Updated: 2026-11-02

EUVDEUVD-2019-17813 No score

ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.

Record: EUVD-2019-17813
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8pw3-c4j5-q2gw 9.8

ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query]...

ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.

Record: GHSA-8pw3-c4j5-q2gw
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

OSVALPINE-CVE-2019-8423 9.8

ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.

Record: ALPINE-CVE-2019-8423
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSV 9.8

ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.

Record: CVE-2019-8423
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-8423 9.8

ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.

Record: DEBIAN-CVE-2019-8423
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-8423 9.8

ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.

Record: UBUNTU-CVE-2019-8423
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

zoneminder

Affected packages

Affected packages
Package	Affected	Fixed
`zoneminder` Alpine:v3.15	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.16	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.17	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.18	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.19	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.20	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.21	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.22	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.23	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.24	before 1.36.7-r0	1.36.7-r0

Show 10 moreShow less

Affected packages
Package	Affected	Fixed
`zoneminder` Debian:12	All versions, plus listed versions 1.36.33+dfsg1-11.36.35+dfsg1-11.36.37+dfsg1-1	None known
`zoneminder` Debian:13	All versions, plus listed versions 1.36.35+dfsg1-11.36.37+dfsg1-1	None known
`zoneminder` Debian:14	All versions, plus listed versions 1.36.35+dfsg1-11.36.37+dfsg1-1	None known
`zoneminder` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.28.1-81.29.0+dfsg-11.29.0+dfsg-1ubuntu11.29.0+dfsg-1ubuntu21.29.0+dfsg-1ubuntu2+esm1	None known
`zoneminder` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 1.32.3-2build11.32.3-2ubuntu11.32.3-2ubuntu21.32.3-2ubuntu2+esm1	None known
`zoneminder` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 1.36.7+dfsg1-11.36.10+dfsg1-11.36.11+dfsg1-11.36.12+dfsg1-11.36.12+dfsg1-1ubuntu0.1~esm1	None known
`zoneminder` Ubuntu:24.04:LTS	All versions, plus listed versions 1.36.33+dfsg1-1build11.36.33+dfsg1-1build21.36.33+dfsg1-1build31.36.33+dfsg1-1build4	None known
`zoneminder` Ubuntu:25.10	All versions, plus listed versions 1.36.35+dfsg1-1	None known
`zoneminder` Ubuntu:26.10	All versions, plus listed versions 1.36.37+dfsg1-1	None known
`zoneminder` Ubuntu:26.04:LTS	All versions, plus listed versions 1.36.35+dfsg1-11.36.37+dfsg1-1	None known

History

History
When	Changed	Sources
2026-11-03	affected, aliases, facts, references	OSV
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 4 moreShow less