Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
97 results · page 1 of 2
Oct 16, 2026ZoneMinder is a free, open source closed-circuit television software application.CVE-2026-30971 · Other software · ZoneMinder · reported by GitHubHigh 8.8
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026ZoneMinder is a free, open source closed-circuit television software application.CVE-2026-102608 · Other software · ZoneMinder · reported by GitHubCritical 9
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026ZoneMinder is a free, open source closed-circuit television software application.CVE-2026-102607 · Other software · ZoneMinder · reported by GitHubHigh 8.8
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026ZoneMinder is a free, open source closed-circuit television software application.CVE-2026-104198 · Other software · ZoneMinder · reported by GitHubMedium 5.3
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken() returns false when a token is malformed or has an invalid signature, but the caller assigns that value to the global $user variable; because web/index.php tests isset($user), boolean false is treated as a present user and the normal login redirect is skipped. This can dispatch views that rely on the outer authentication gate, including the zones view, which accepts an attacker-selected monitor ID and discloses monitor and zone metadata without an independent permission check. Permission helpers receive the false user value and deny privileged operations, so unauthorized state changes have not been established. This vulnerability is fixed in version 1.36.63, where conversion to ZM\User objects causes invalid token state to fail before view dispatch. Later defense-in-depth changes explicitly leave $user unset after failed token validation and reject non-ZM\User values at the web authentication gate.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint.CVE-2026-102297 · Other software · ZoneMinder · reported by VulnCheckMedium 5.3
ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting atCVE-2026-102296 · Other software · ZoneMinder · reported by VulnCheckHigh 8.3
ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Attackers can send crafted HTTP responses with oversized status messages, Connection headers, Content-Type values, or multipart boundaries to corrupt parser state and crash the capture process or corrupt memory.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files.CVE-2024-58386 · Other software · ZoneMinder · reported by VulnCheckHigh 7.1
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to output_file, enabling attackers with Events view permission to access sensitive files like configuration files containing database credentials.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026ZoneMinder is a free, open source closed-circuit television software application.CVE-2026-54258 · Other software · ZoneMinder · reported by GitHubMedium 6.5
ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse `Events=View` and/or `Snapshots=View` permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI correctly hides the restricted monitor and its events, but direct event media views accept an arbitrary `eid` and stream media from the event path without enforcing the event/monitor-level ACL. This exposes private surveillance footage across monitor boundaries. Versions 1.36.39, 1.38.4, and 1.39.11 fix the issue.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality.CVE-2026-76060 · Other software · Zoneminder · reported by ics-cert@hq.dhs.govHigh 8.7
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the CVE-2026-72556 · Other software · ZoneMinder · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.8
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\User class, causing PHP __call() to return a truthy value that bypasses the permission check for all users. Any authenticated user can trigger filter-based OS command execution regardless of their assigned role.
- Product
- ZoneMinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026ZoneMinder is a free, open source closed-circuit television software application.CVE-2026-27470 · Other software · ZoneMinder · reported by GitHubHigh 8.8
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function. Event field values (specifically Name and Cause) are stored safely via parameterized queries but are later retrieved and concatenated directly into SQL WHERE clauses without escaping. An authenticated user with Events edit and view permissions can exploit this to execute arbitrary SQL queries.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php.CVE-2025-65791 · Other software · Zoneminder · reported by MITRECritical 9.8
ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. NOTE: this is disputed by the Supplier because there is no unsanitized user input to web/views/image.php.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024ZoneMinder is a free, open source closed-circuit television software application.CVE-2024-51482 · Other software · ZoneMinder · reported by GitHubCritical 9.9
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* <= 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is fixed in 1.37.65.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted payCVE-2023-31493 · Other software · zoneminder · reported by MITREMedium 6.6
RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted payload and escalate privileges allowing execution of any commands on the remote system.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024ZoneMinder is a free, open source closed-circuit television software application.CVE-2024-43360 · Other software · ZoneMinder · reported by GitHubCritical 9.8
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024ZoneMinder is a free, open source closed-circuit television software application.CVE-2024-43359 · Other software · ZoneMinder · reported by GitHubNone
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the montagereview via the displayinterval, speed, and scale parameters. This vulnerability is fixed in 1.36.34 and 1.37.61.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024ZoneMinder is a free, open source closed-circuit television software application.CVE-2024-43358 · Other software · ZoneMinder · reported by GitHubMedium 6.1
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the filter view via the filter[Id]. This vulnerability is fixed in 1.36.34 and 1.37.61.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024ZoneMinder is a free, open source Closed-circuit television software application.CVE-2023-41884 · Other software · ZoneMinder · reported by GitHubHigh 7.1
ZoneMinder is a free, open source Closed-circuit television software application. In WWW/AJAX/watch.php, Line: 51 takes a few parameter in sql query without sanitizing it which makes it vulnerable to sql injection. This vulnerability is fixed in 1.36.34.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024Cross Site Scripting (XSS) vulnerability in ZoneMinder before version 1.34.21, allows remote attackers execute arbitrary code, escalate privileges, and obtain sCVE-2020-25730 · Other software · Zoneminder · reported by MITREHigh 8.2
Cross Site Scripting (XSS) vulnerability in ZoneMinder before version 1.34.21, allows remote attackers execute arbitrary code, escalate privileges, and obtain sensitive information via PHP_SELF component in classic/views/download.php.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26039 · Other software · ZoneMinder · reported by GitHubHigh 7.1
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl() in (/web/api/app/Controller/HostController.php). Any authenticated user can construct an api command to execute any shell command as the web user. This issue is patched in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26038 · Other software · ZoneMinder · reported by GitHubMedium 5.4
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via web/ajax/modal.php, where an arbitrary php file path can be passed in the request and loaded. This issue is patched in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26037 · Other software · ZoneMinder · reported by GitHubHigh 8.9
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an SQL Injection. The minTime and maxTime request parameters are not properly validated and could be used execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26036 · Other software · ZoneMinder · reported by GitHubHigh 8.1
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via /web/index.php. By controlling $view, any local file ending in .php can be executed. This is supposed to be mitigated by calling detaintPath, however dentaintPath does not properly sandbox the path. This can be exploited by constructing paths like "..././", which get replaced by "../". This issue is patched in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26035 · Other software · ZoneMinder · reported by GitHubHigh 7.2
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id. This issue is fixed in This issue is fixed in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26034 · Other software · ZoneMinder · reported by GitHubCritical 9.6
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are affected by a SQL Injection vulnerability. The (blind) SQL Injection vulnerability is present within the `filter[Query][terms][0][attr]` query string parameter of the `/zm/index.php` endpoint. A user with the View or Edit permissions of Events may execute arbitrary SQL. The resulting impact can include unauthorized data access (and modification), authentication and/or authorization bypass, and remote code execution.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26032 · Other software · ZoneMinder · reported by GitHubHigh 8.9
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain SQL Injection via malicious jason web token. The Username field of the JWT token was trusted when performing an SQL query to load the user. If an attacker could determine the HASH key used by ZoneMinder, they could generate a malicious JWT token and use it to execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-25825 · Other software · ZoneMinder · reported by GitHubHigh 7.7
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 are vulnerable to Cross-site Scripting. Log entries can be injected into the database logs, containing a malicious referrer field. This is unescaped when viewing the logs in the web ui. This issue is patched in version 1.36.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user.CVE-2022-30769 · Other software · Zoneminder · reported by MITREMedium 4.6
Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field when an Admin (or nCVE-2022-30768 · Other software · Zoneminder · reported by MITREMedium 5.4
A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field when an Admin (or non-Admin users that can see other users logged into the platform) clicks on Logout. NOTE: this exists in later versions than CVE-2019-7348 and requires a different attack method.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022ZoneMinder is a free, open source Closed-circuit television software application.CVE-2022-39291 · Other software · ZoneMinder · reported by GitHubMedium 5.4
ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log information to the "/zm/index.php" endpoint. Submission is not rate controlled and could affect database performance and/or consume all storage resources. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 7, 2022ZoneMinder is a free, open source Closed-circuit television software application.CVE-2022-39290 · Other software · ZoneMinder · reported by GitHubHigh 8
ZoneMinder is a free, open source Closed-circuit television software application. In affected versions authenticated users can bypass CSRF keys by modifying the request supplied to the Zoneminder web application. These modifications include replacing HTTP POST with an HTTP GET and removing the CSRF key from the request. An attacker can take advantage of this by using an HTTP GET request to perform actions with no CSRF protection. This could allow an attacker to cause an authenticated user to perform unexpected actions on the web application. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 7, 2022ZoneMinder is a free, open source Closed-circuit television software application.CVE-2022-39289 · Other software · ZoneMinder · reported by GitHubCritical 9.1
ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS) CVE-2022-39285 · Other software · ZoneMinder · reported by GitHubHigh 7.6
ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets. This then allows a malicious user to provide code that will execute when a user views the specific log on the "view=log" page. This vulnerability allows an attacker to store code within the logs that will be executed when loaded by a legitimate user. These actions will be performed with the permission of the victim. This could lead to data loss and/or further exploitation including account takeover. This issue has been addressed in versions `1.36.27` and `1.37.24`. Users are advised to upgrade. Users unable to upgrade should disable database logging.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 26, 2022ZoneMinder before 1.36.13 allows remote code execution via an invalid language.CVE-2022-29806 · Other software · Zoneminder · reported by MITRECritical 9.8
ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to exploitability.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comforums.zoneminder.com
Sep 17, 2020ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php.CVE-2020-25729 · Other software · Zoneminder · reported by MITREMedium 6.1
ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.zoneminder.comgithub.com
Jun 29, 2019Stored XSS in the Filters page (Name field) in ZoneMinder 1.32.3 allows a malicious user to embed and execute JavaScript code in the browser of any user who navCVE-2019-13072 · Other software · Zoneminder · reported by MITREMedium 5.4
Stored XSS in the Filters page (Name field) in ZoneMinder 1.32.3 allows a malicious user to embed and execute JavaScript code in the browser of any user who navigates to this page.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 17, 2019ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter.CVE-2019-8429 · Other software · Zoneminder · reported by MITRECritical 9.8
ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2019ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroup[MonitorIds][] value.CVE-2019-8428 · Other software · Zoneminder · reported by MITRECritical 9.8
ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroup[MonitorIds][] value.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2019daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters.CVE-2019-8427 · Other software · Zoneminder · reported by MITRECritical 9.8
daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2019skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControl[MinTiltRange] parameter.CVE-2019-8426 · Other software · Zoneminder · reported by MITREMedium 6.1
skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControl[MinTiltRange] parameter.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2019includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages.CVE-2019-8425 · Other software · Zoneminder · reported by MITREMedium 6.1
includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2019ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter.CVE-2019-8424 · Other software · Zoneminder · reported by MITRECritical 9.8
ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2019ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.CVE-2019-8423 · Other software · Zoneminder · reported by MITRECritical 9.8
ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2019Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'state' (aka Run State) (state.php) does no input validation to the vaCVE-2019-7352 · Other software · Zoneminder · reported by MITREMedium 6.1
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'state' (aka Run State) (state.php) does no input validation to the value supplied to the 'New State' (aka newState) field, allowing an attacker to execute HTML or JavaScript code.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2019Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom LoCVE-2019-7351 · Other software · Zoneminder · reported by MITREMedium 6.5
Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom Log message provided by the attacker in the 'log' view page, as demonstrated by the message=User%20'admin'%20Logged%20in value.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2019Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victimCVE-2019-7350 · Other software · Zoneminder · reported by MITREHigh 7.3
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies (between 3 and 5) is being generated when a user successfully logs in, and these sets overlap for successive logins.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2019Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitor[VCVE-2019-7349 · Other software · Zoneminder · reported by MITREMedium 6.1
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitor[V4LCapturesPerFrame]' parameter value in the view monitor (monitor.php) because proper filtration is omitted.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2019Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'usernameCVE-2019-7348 · Other software · Zoneminder · reported by MITREMedium 6.1
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'username' parameter value in the view user (user.php) because proper filtration is omitted.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2019A Time-of-check Time-of-use (TOCTOU) Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deletioCVE-2019-7347 · Other software · Zoneminder · reported by MITREHigh 7.5
A Time-of-check Time-of-use (TOCTOU) Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deletion from the users table. This allows a nonexistent user to access and modify records (add/delete Monitors, Users, etc.).
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2019A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback function is called displaying a "Try again" button, which alloCVE-2019-7346 · Other software · Zoneminder · reported by MITREHigh 8.8
A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback function is called displaying a "Try again" button, which allows resending the failed request, making the CSRF attack successful.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.