ZO
Product
zoneminder
96
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Severity mix
Critical 17High 17Medium 54Low 0
Watch
Add zoneminder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-51482 | 9.9 | Oct 31 | Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64 Affected: >= 1.37.0, < 1.37.65 |
| CVE-2025-65791 | 9.8 | Feb 18 | ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php Affected: 1.36.34 |
| CVE-2024-43360 | 9.8 | Aug 12 | ZoneMinder Time-based SQL Injection Affected: < 1.36.34; >= 1.37.0, < 1.37.61 |
| CVE-2023-26037 | 9.8 | Feb 25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras Affected: before 1.36.33; 1.37.00 before 1.37.33 |
| CVE-2023-26036 | 9.8 | Feb 25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras Affected: before 1.36.33; 1.37.00 before 1.37.33 |
| CVE-2023-26035 | 9.8 | Feb 25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras Affected: before 1.36.33; 1.37.00 before 1.37.33 |
| CVE-2022-29806 | 9.8 | Apr 26 | ZoneMinder before 1.36.13 allows remote code execution via an invalid language Affected: before 1.36.13 |
| CVE-2019-8429 | 9.8 | Feb 18 | ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter Affected: before 1.32.3 |
| CVE-2019-8423 | 9.8 | Feb 18 | ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter Affected: through 1.32.3 |
| CVE-2019-8424 | 9.8 | Feb 18 | ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter Affected: before 1.32.3 |
| CVE-2019-8427 | 9.8 | Feb 18 | daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters Affected: before 1.32.3 |
| CVE-2019-8428 | 9.8 | Feb 18 | ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroup[MonitorIds][] value Affected: before 1.32.3 |
| CVE-2019-6991 | 9.8 | Jan 28 | A classic Stack-based buffer overflow exists in the zmLoadUser() function in zm_user.cpp of the zmu binary in ZoneMinder through 1.32.3, allowing an unauthenticated attacker to… Affected: through 1.32.3 |
| CVE-2018-1000833 | 9.8 | Dec 20 | ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF,… Affected: through 1.32.2 |
| CVE-2018-1000832 | 9.8 | Dec 20 | ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF,… Affected: through 1.32.2 |
| CVE-2016-10204 | 9.8 | Mar 3 | SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php Affected: through 1.30.0 |
| CVE-2026-102608 | 9.0 | Oct 16 | ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php) Affected: >= 1.37.48, < 1.38.3 |
| CVE-2026-30971 | 8.8 | Oct 16 | ZoneMinder: Authenticated RCE via command injection in monitor Device Path Affected: < 1.36.40; >= 1.38.0, < 1.38.2; >= 1.39.0, < 1.39.2 |
| CVE-2026-102607 | 8.8 | Oct 16 | ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature Affected: < 1.38.2 |
| CVE-2026-76060 | 8.8 | Aug 27 | OS Command Injection in PayRange API Affected: 1.37.48 before 1.38.3 |
| CVE-2026-72556 | 8.8 | Aug 11 | ZoneMinder ZoneMinder - Remote Code Execution Affected: through 1.39.17 |
| CVE-2026-27470 | 8.8 | Feb 21 | ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields Affected: < 1.36.38; >= 1.37.61, < 1.38.1 |
| CVE-2023-26039 | 8.8 | Feb 25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras Affected: before 1.36.33; 1.37.00 before 1.37.33 |
| CVE-2023-26034 | 8.8 | Feb 25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras Affected: before 1.36.33; 1.37.00 before 1.37.33 |
| CVE-2019-7346 | 8.8 | Feb 4 | A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback function is called displaying a "Try again" button, which allows resending the… Affected: through 1.32.3 |
| CVE-2016-10206 | 8.8 | Mar 3 | Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and… Affected: through 1.30.0 |
| CVE-2017-5368 | 8.8 | Feb 6 | ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF (Cross Site Request Forgery) which allows a remote attack to make changes to the web… Affected: 1.29.0; 1.30.0 |
| CVE-2020-25730 | 8.2 | Apr 4 | Cross Site Scripting (XSS) vulnerability in ZoneMinder before version 1.34.21, allows remote attackers execute arbitrary code, escalate privileges, and obtain sensitive… Affected: before 1.34.21 |
| CVE-2023-26032 | 8.1 | Feb 25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras Affected: before 1.36.33; 1.37.00 before 1.37.33 |
| CVE-2022-39289 | 7.5 | Oct 7 | Database log access in ZoneMinder Affected: < 1.36.27; >= 1.37.0, < 1.37.24 |
| CVE-2019-7347 | 7.5 | Feb 4 | A Time-of-check Time-of-use (TOCTOU) Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deletion from the users… Affected: through 1.32.3 |
| CVE-2016-10140 | 7.5 | Jan 13 | Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote… Affected: 1.30.0 |
| CVE-2019-7350 | 7.3 | Feb 4 | Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account Affected: through 1.32.3 |
| CVE-2016-10205 | 7.3 | Mar 3 | Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie Affected: through 1.30.0 |
| CVE-2023-31493 | 6.6 | Oct 15 | RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted payload and escalate… Affected: through 1.36.33 |
| CVE-2026-102296 | 6.5 | Sep 28 | ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response Affected: before 1.38.4 |
| CVE-2024-58386 | 6.5 | Sep 28 | ZoneMinder 1.37.x Path Traversal via files view Affected: 1.37.0 before 1.38.0 |
| CVE-2026-54258 | 6.5 | Sep 11 | Cross-monitor event media authorization bypass in direct event media endpoints Affected: < 1.36.39; >= 1.37.0, < 1.38.4; >= 1.39.0, < 1.39.11 |
| CVE-2023-41884 | 6.5 | Aug 12 | ZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.php Affected: < 1.36.34 |
| CVE-2023-26038 | 6.5 | Feb 25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras Affected: before 1.36.33; 1.37.00 before 1.37.33 |
| CVE-2022-39290 | 6.5 | Oct 7 | CSRF key bypass using HTTP methods in zoneminder Affected: < 1.36.27; >= 1.37.0, < 1.37.24 |
| CVE-2019-7351 | 6.5 | Feb 4 | Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom Log message provided… Affected: through 1.32.3 |
| CVE-2024-43359 | 6.1 | Aug 12 | XSS vulnerabilities in montagereview Affected: < 1.36.34; >= 1.37.0, < 1.37.61 |
| CVE-2024-43358 | 6.1 | Aug 12 | XSS vulnerability in filter view Affected: < 1.36.34; >= 1.37.0, < 1.37.61 |
| CVE-2023-25825 | 6.1 | Feb 25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras Affected: before 1.36.33; 1.37.0 before 1.37.33 |
| CVE-2020-25729 | 6.1 | Sep 17 | ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php Affected: before 1.34.21 |
| CVE-2019-8425 | 6.1 | Feb 18 | includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages Affected: before 1.32.3 |
| CVE-2019-8426 | 6.1 | Feb 18 | skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControl[MinTiltRange] parameter Affected: before 1.32.3 |
| CVE-2019-7333 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile' parameter value in… Affected: through 1.32.3 |
| CVE-2019-7325 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as multiple views under web/skins/classic/views insecurely utilize $_REQUEST['PHP_SELF'], without… Affected: through 1.32.3 |