Zabbix Frontend vulnerabilities

• zabbix frontend, zabbix +1 more Frontend DoS vulnerability due to asymmetric resource consumption CVE-2025-49643 Fix available 6.0 MediumDecember 1, 2025
• zabbix frontend, zabbix +1 more Frontend arbitrary file read in oauth.authorize action CVE-2025-27232 Fix available 6.8 MediumDecember 1, 2025
• zabbix frontend, zabbix +1 more JS - Internal strings in HTTP headers CVE-2024-42330 Fix available 9.1 CriticalNovember 27, 2024
• zabbix frontend, zabbix, zabbix server +2 more Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget. CVE-2023-32725 Fix available 9.6 CriticalDecember 18, 2023
• zabbix frontend, palantir com.palantir.foundry:foundry-frontend +1 more DOM XSS in Developer mode dashboard via redirect GET parameter CVE-2023-30958 4.7 MediumAugust 3, 2023
• zabbix frontend, zabbix +1 more Insufficient validation of Action form input fields CVE-2023-29457 Fix available 6.3 MediumJuly 13, 2023
• zabbix frontend, zabbix +1 more Inefficient URL schema validation CVE-2023-29456 Fix available 5.7 MediumJuly 13, 2023
• zabbix frontend, zabbix +1 more Reflected XSS in several fields of graph form CVE-2023-29455 Fix available 5.4 MediumJuly 13, 2023
• zabbix frontend, zabbix +1 more Persistent XSS in the user form CVE-2023-29454 Fix available 5.4 MediumJuly 13, 2023
• dependencytrack frontend X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance mode CVE-2022-43515 Fix available 5.3 MediumDecember 5, 2022
• dependencytrack frontend, zabbix, fedoraproject fedora +2 more Reflected XSS in the backurl parameter of Zabbix Frontend CVE-2022-40626 Fix available 4.8 MediumSeptember 14, 2022
• dependencytrack frontend, zabbix +1 more Reflected XSS in graphs page of Zabbix Frontend CVE-2022-35230 Fix available 3.7 LowJuly 6, 2022
• dependencytrack frontend, zabbix +1 more Reflected XSS in discovery page of Zabbix Frontend CVE-2022-35229 Fix available 3.7 LowJuly 6, 2022
• dependencytrack frontend, debian linux, fedoraproject fedora +2 more Reflected XSS in graph configuration window of Zabbix Frontend CVE-2022-24919 Fix available 3.7 LowMarch 9, 2022
• dependencytrack frontend, fedoraproject fedora +1 more Reflected XSS in item configuration window of Zabbix Frontend CVE-2022-24918 Fix available 3.7 LowMarch 9, 2022
• dependencytrack frontend, debian linux, fedoraproject fedora +2 more Reflected XSS in service configuration window of Zabbix Frontend CVE-2022-24917 Fix available 3.7 LowMarch 9, 2022
• dependencytrack frontend, debian linux, fedoraproject fedora +2 more Reflected XSS in action configuration window of Zabbix Frontend CVE-2022-24349 Fix available 4.6 MediumMarch 9, 2022
• dependencytrack frontend, zabbix, debian linux +1 more +3 more Possible view of the setup pages by unauthenticated users if config file already exists CVE-2022-23134 In KEVPublic exploitFix available EPSS 95.3% 3.7 LowJanuary 13, 2022
• dependencytrack frontend, zabbix, fedoraproject fedora +2 more Stored XSS in host groups configuration window in Zabbix Frontend CVE-2022-23133 Fix available 6.3 MediumJanuary 13, 2022
• dependencytrack frontend, zabbix +1 more Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML CVE-2022-23131 In KEVPublic exploit EPSS 95.7% 9.1 CriticalJanuary 13, 2022