Zoneminder vulnerabilities

Products

• Zoneminder 96

Newest

• zoneminder ZoneMinder: Authenticated RCE via command injection in monitor Device Path CVE-2026-30971 8.8 HighOctober 16, 2026
• zoneminder ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature CVE-2026-102607 Public exploit 8.8 HighOctober 16, 2026
• zoneminder ZoneMinder failed token handling bypasses web authentication CVE-2026-104198 5.3 MediumOctober 15, 2026
• zoneminder ZoneMinder before 1.38.4 Incorrect Authorization in frames API index CVE-2026-102297 5.3 MediumSeptember 28, 2026
• zoneminder ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response CVE-2026-102296 8.3 HighSeptember 28, 2026
• zoneminder ZoneMinder 1.37.x Path Traversal via files view CVE-2024-58386 7.1 HighSeptember 28, 2026
• zoneminder Cross-monitor event media authorization bypass in direct event media endpoints CVE-2026-54258 6.5 MediumSeptember 11, 2026
• zoneminder ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php) CVE-2026-102608 9.0 CriticalAugust 27, 2026
• zoneminder OS Command Injection in PayRange API CVE-2026-76060 Public exploit 8.7 HighAugust 27, 2026
• zoneminder ZoneMinder ZoneMinder - Remote Code Execution CVE-2026-72556 8.8 HighAugust 11, 2026
• zoneminder ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields CVE-2026-27470 Public exploitFix available 8.8 HighFebruary 21, 2026
• zoneminder ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application... CVE-2025-65791 Public exploitDisputed 9.8 CriticalFebruary 18, 2026
• zoneminder Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64 CVE-2024-51482 Public exploit EPSS 36.6% 10.0 CriticalOctober 31, 2024
• zoneminder RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted payload and escalate privileges allowing ex… CVE-2023-31493 6.6 MediumOctober 15, 2024
• zoneminder ZoneMinder Time-based SQL Injection CVE-2024-43360 Fix available 9.8 CriticalAugust 12, 2024
• zoneminder XSS vulnerabilities in montagereview CVE-2024-43359 Fix available 0.0 NoneAugust 12, 2024
• zoneminder XSS vulnerability in filter view CVE-2024-43358 Fix available 6.1 MediumAugust 12, 2024
• zoneminder ZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.php CVE-2023-41884 Fix available 7.1 HighAugust 12, 2024
• zoneminder Cross Site Scripting (XSS) vulnerability in ZoneMinder before version 1.34.21, allows remote... CVE-2020-25730 Fix available 8.2 HighApril 4, 2024
• zoneminder ZoneMinder vulnerable to OS Command injection in daemonControl() API CVE-2023-26039 Public exploitFix available 7.1 HighFebruary 25, 2023
• zoneminder ZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php` CVE-2023-26038 Fix available 5.4 MediumFebruary 25, 2023
• zoneminder ZoneMinder contains SQL Injection via report_event_audit CVE-2023-26037 Fix available 8.9 HighFebruary 25, 2023
• zoneminder ZoneMinder contains Local File Inclusion vulnerability CVE-2023-26036 Fix available 8.1 HighFebruary 25, 2023
• zoneminder ZoneMinder vulnerable to Missing Authorization CVE-2023-26035 Public exploitFix available EPSS 80.5% 7.2 HighFebruary 25, 2023
• zoneminder ZoneMinder SQL Injection CVE-2023-26034 Fix available 9.6 CriticalFebruary 25, 2023
• zoneminder ZoneMinder contains SQL injection via malicious Jason Web Token CVE-2023-26032 Fix available 8.9 HighFebruary 25, 2023
• zoneminder ZoneMinder contains Cross-site Scripting via log viewing CVE-2023-25825 Fix available 7.7 HighFebruary 25, 2023
• zoneminder Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie... CVE-2022-30769 4.6 MediumNovember 15, 2022
• zoneminder A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute... CVE-2022-30768 5.4 MediumNovember 15, 2022
• zoneminder Denial of service through logs in zoneminder CVE-2022-39291 Public exploitFix available 5.4 MediumOctober 7, 2022
• zoneminder CSRF key bypass using HTTP methods in zoneminder CVE-2022-39290 Public exploitFix available 8.0 HighOctober 7, 2022
• zoneminder Database log access in ZoneMinder CVE-2022-39289 Fix available 9.1 CriticalOctober 7, 2022
• zoneminder Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder CVE-2022-39285 Public exploitFix available 7.6 HighOctober 7, 2022
• zoneminder ZoneMinder before 1.36.13 allows remote code execution via an invalid language. CVE-2022-29806 Public exploitFix available EPSS 67.1% 9.8 CriticalApril 26, 2022
• zoneminder ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php. CVE-2020-25729 Fix available 6.1 MediumSeptember 17, 2020
• zoneminder Stored XSS in the Filters page (Name field) in ZoneMinder 1.32.3 allows a malicious user to embed... CVE-2019-13072 Fix available 5.4 MediumJune 30, 2019
• zoneminder ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj]... CVE-2019-8429 9.8 CriticalFebruary 18, 2019
• zoneminder ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql... CVE-2019-8428 Fix available 9.8 CriticalFebruary 18, 2019
• zoneminder daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via... CVE-2019-8427 9.8 CriticalFebruary 18, 2019
• zoneminder skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array,... CVE-2019-8426 Fix available 6.1 MediumFebruary 18, 2019
• zoneminder includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages. CVE-2019-8425 6.1 MediumFebruary 18, 2019
• zoneminder ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter. CVE-2019-8424 Fix available 9.8 CriticalFebruary 18, 2019
• zoneminder ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query]... CVE-2019-8423 Fix available 9.8 CriticalFebruary 18, 2019
• zoneminder Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'state'... CVE-2019-7352 Fix available 6.1 MediumFebruary 4, 2019
• zoneminder Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit... CVE-2019-7351 Fix available 6.5 MediumFebruary 4, 2019
• zoneminder Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session... CVE-2019-7350 Fix available 7.3 HighFebruary 4, 2019
• zoneminder Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to... CVE-2019-7349 Fix available 6.1 MediumFebruary 4, 2019
• zoneminder Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an... CVE-2019-7348 Fix available 6.1 MediumFebruary 4, 2019
• zoneminder A Time-of-check Time-of-use (TOCTOU) Race Condition exists in ZoneMinder through 1.32.3 as a... CVE-2019-7347 Fix available 7.5 HighFebruary 4, 2019
• zoneminder A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback... CVE-2019-7346 Fix available 8.8 HighFebruary 4, 2019
• Show olderLoading…