Advisories · Technology
zoneminder.
Every CVE that names zoneminder among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.8 High
ZoneMinder: Authenticated RCE via command injection in monitor Device Path
- zoneminder
- Command injection
- CVSS 9.0 CriticalCritical · CVSS 9+
ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)
- zoneminder
- Command injection
- CVSS 8.8 High
ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
- zoneminder
- Command injection
- CVSS 5.3 Medium
ZoneMinder failed token handling bypasses web authentication
- zoneminder
- Authentication bypass
- CWE-697
- CVSS 5.3 Medium
ZoneMinder before 1.38.4 Incorrect Authorization in frames API index
- zoneminder
- Broken access control
- CVSS 8.3 High
ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response
- zoneminder
- Memory corruption
- CVSS 7.1 High
ZoneMinder 1.37.x Path Traversal via files view
- zoneminder
- Path traversal
- CVSS 6.5 Medium
Cross-monitor event media authorization bypass in direct event media endpoints
- zoneminder
- Broken access control
- CVSS 8.7 High
OS Command Injection in PayRange API
- Zoneminder
- Command injection
- CVSS 8.8 High
ZoneMinder ZoneMinder - Remote Code Execution
- ZoneMinder
- Command injection
- CVSS 8.8 High
ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields
- zoneminder
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64
- zoneminder
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
ZoneMinder Time-based SQL Injection
- zoneminder
- SQL injection
- CVSS 0.0 None
XSS vulnerabilities in montagereview
- zoneminder
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
XSS vulnerability in filter view
- zoneminder
- Cross-site scripting (XSS)
- CVSS 7.1 High
ZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.php
- zoneminder
- SQL injection
- CVSS 7.1 High
ZoneMinder vulnerable to OS Command injection in daemonControl() API
- zoneminder
- Command injection
- CVSS 5.4 Medium
ZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php`
- zoneminder
- CWE-426
- CVSS 8.9 High
ZoneMinder contains SQL Injection via report_event_audit
- zoneminder
- SQL injection
- CVSS 8.1 High
ZoneMinder contains Local File Inclusion vulnerability
- zoneminder
- CWE-426
- CVSS 7.2 HighCritical · CVSS 7+ and EPSS
ZoneMinder vulnerable to Missing Authorization
- zoneminder
- Broken access control
- CVSS 9.6 CriticalCritical · CVSS 9+
ZoneMinder SQL Injection
- zoneminder
- SQL injection
- CVSS 8.9 High
ZoneMinder contains SQL injection via malicious Jason Web Token
- zoneminder
- SQL injection
- CVSS 7.7 High
ZoneMinder contains Cross-site Scripting via log viewing
- zoneminder
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Denial of service through logs in zoneminder
- zoneminder
- CWE-20
- CVSS 8.0 High
CSRF key bypass using HTTP methods in zoneminder
- zoneminder
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
Database log access in ZoneMinder
- zoneminder
- Information disclosure
- Authentication bypass
- CVSS 7.6 High
Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder
- zoneminder
- Cross-site scripting (XSS)