ZO
Product
zoneminder
96
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Severity mix
Critical 17High 17Medium 54Low 0
Watch
Add zoneminder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-31493 | 6.6 | Oct 15 | RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted payload and escalate… Affected: through 1.36.33 |
| CVE-2026-102296 | 6.5 | Sep 28 | ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response Affected: before 1.38.4 |
| CVE-2024-58386 | 6.5 | Sep 28 | ZoneMinder 1.37.x Path Traversal via files view Affected: 1.37.0 before 1.38.0 |
| CVE-2026-54258 | 6.5 | Sep 11 | Cross-monitor event media authorization bypass in direct event media endpoints Affected: < 1.36.39; >= 1.37.0, < 1.38.4; >= 1.39.0, < 1.39.11 |
| CVE-2023-41884 | 6.5 | Aug 12 | ZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.php Affected: < 1.36.34 |
| CVE-2023-26038 | 6.5 | Feb 25 | ZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php` Affected: < 1.36.33; >= 1.37.0, < 1.37.33 |
| CVE-2022-39290 | 6.5 | Oct 7 | CSRF key bypass using HTTP methods in zoneminder Affected: < 1.36.27; >= 1.37.0, < 1.37.24 |
| CVE-2019-7351 | 6.5 | Feb 4 | Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom Log message provided… Affected: through 1.32.3 |
| CVE-2024-43359 | 6.1 | Aug 12 | XSS vulnerabilities in montagereview Affected: < 1.36.34; >= 1.37.0, < 1.37.61 |
| CVE-2024-43358 | 6.1 | Aug 12 | XSS vulnerability in filter view Affected: < 1.36.34; >= 1.37.0, < 1.37.61 |
| CVE-2023-25825 | 6.1 | Feb 25 | ZoneMinder contains Cross-site Scripting via log viewing Affected: < 1.36.33 |
| CVE-2020-25729 | 6.1 | Sep 17 | ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php Affected: before 1.34.21 |
| CVE-2019-8425 | 6.1 | Feb 18 | includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages Affected: before 1.32.3 |
| CVE-2019-8426 | 6.1 | Feb 18 | skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControl[MinTiltRange] parameter Affected: before 1.32.3 |
| CVE-2019-7333 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile' parameter value in… Affected: through 1.32.3 |
| CVE-2019-7325 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as multiple views under web/skins/classic/views insecurely utilize $_REQUEST['PHP_SELF'], without… Affected: through 1.32.3 |
| CVE-2019-7326 | 6.1 | Feb 4 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Host' parameter value in… Affected: through 1.32.3 |
| CVE-2019-7327 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'scale' parameter value in the… Affected: through 1.32.3 |
| CVE-2019-7328 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'scale' parameter value in the… Affected: through 1.32.3 |
| CVE-2019-7329 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the form action on multiple views utilizes $_SERVER['PHP_SELF'] insecurely, mishandling any arbitrary… Affected: through 1.32.3 |
| CVE-2019-7330 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'show' parameter value in the… Affected: through 1.32.3 |
| CVE-2019-7331 | 6.1 | Feb 4 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 while editing an existing monitor field named "signal check color" (monitor.php) Affected: through 1.32.3 |
| CVE-2019-7332 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'eid' (aka Event ID) parameter… Affected: through 1.32.3 |
| CVE-2019-7334 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile' parameter value in… Affected: through 1.32.3 |
| CVE-2019-7335 | 6.1 | Feb 4 | Self - Stored XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'log' as it insecurely prints the 'Log Message' value on… Affected: through 1.32.3 |
| CVE-2019-7336 | 6.1 | Feb 4 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view _monitor_filters.php contains takes in input from the user and saves it into the session,… Affected: through 1.32.3 |
| CVE-2019-7338 | 6.1 | Feb 4 | Self - Stored XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'group' as it insecurely prints the 'Group Name' value… Affected: through 1.32.3 |
| CVE-2019-7339 | 6.1 | Feb 4 | POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'level' parameter value in the view… Affected: through 1.32.3 |
| CVE-2019-7340 | 6.1 | Feb 4 | POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filter[Query][terms][0][val]'… Affected: through 1.32.3 |
| CVE-2019-7341 | 6.1 | Feb 4 | Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitor[LinkedMonitors]'… Affected: through 1.32.3 |
| CVE-2019-7342 | 6.1 | Feb 4 | POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filter[AutoExecuteCmd]' parameter… Affected: through 1.32.3 |
| CVE-2019-7343 | 6.1 | Feb 4 | Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitor[Method]' parameter… Affected: through 1.32.3 |
| CVE-2019-7344 | 6.1 | Feb 4 | Reflected XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'filter' as it insecurely prints the 'filter[Name]' (aka… Affected: through 1.32.3 |
| CVE-2019-7348 | 6.1 | Feb 4 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'username' parameter value… Affected: through 1.32.3 |
| CVE-2019-7349 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable… Affected: through 1.32.3 |
| CVE-2019-7352 | 6.1 | Feb 4 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'state' (aka Run State) (state.php) does no input validation to the value supplied to the… Affected: through 1.32.3 |
| CVE-2019-6992 | 6.1 | Jan 28 | A stored-self XSS exists in web/skins/classic/views/controlcaps.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via… Affected: through 1.32.3 |
| CVE-2019-6777 | 6.1 | Jan 24 | An issue was discovered in ZoneMinder v1.32.3 Affected: 1.32.3 |
| CVE-2017-7203 | 6.1 | Mar 21 | A Cross-Site Scripting (XSS) was discovered in ZoneMinder before 1.30.2 Affected: 1.30.2 |
| CVE-2016-10203 | 6.1 | Mar 3 | Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the name when creating a new monitor Affected: through 1.30.0 |
| CVE-2016-10202 | 6.1 | Mar 3 | Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the path info to index.php Affected: through 1.30.0 |
| CVE-2016-10201 | 6.1 | Mar 3 | Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log… Affected: through 1.30.0 |
| CVE-2017-5367 | 6.1 | Feb 6 | Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote… Affected: 1.29.0; 1.30.0 |
| CVE-2017-5595 | 5.5 | Feb 6 | A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which… Affected: through 1.30.0 |
| CVE-2022-30768 | 5.4 | Nov 15 | A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field when an Admin (or non-Admin users that… Affected: 1.36.12 |
| CVE-2022-39291 | 5.4 | Oct 7 | Denial of service through logs in zoneminder Affected: < 1.36.27; >= 1.37.0, <1.37.24 |
| CVE-2022-39285 | 5.4 | Oct 7 | Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder Affected: < 1.36.27; >= 1.37.0, < 1.37.24 |
| CVE-2019-13072 | 5.4 | Jun 30 | Stored XSS in the Filters page (Name field) in ZoneMinder 1.32.3 allows a malicious user to embed and execute JavaScript code in the browser of any user who navigates to this page Affected: 1.32.3 |
| CVE-2019-6990 | 5.4 | Jan 28 | A stored-self XSS exists in web/skins/classic/views/zones.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a… Affected: through 1.32.3 |
| CVE-2026-104198 | 5.3 | Oct 15 | ZoneMinder failed token handling bypasses web authentication Affected: >= 1.34.0, < 1.36.63 |