ZO
Product
zoneminder
96
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Severity mix
Critical 17High 17Medium 54Low 0
Watch
Add zoneminder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-51482 | 9.9 | Oct 31 | Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64 Affected: >= 1.37.0, < 1.37.65 |
| CVE-2025-65791 | 9.8 | Feb 18 | ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php Affected: 1.36.34 |
| CVE-2024-43360 | 9.8 | Aug 12 | ZoneMinder Time-based SQL Injection Affected: < 1.36.34; >= 1.37.0, < 1.37.61 |
| CVE-2023-26037 | 9.8 | Feb 25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras Affected: before 1.36.33; 1.37.00 before 1.37.33 |
| CVE-2023-26036 | 9.8 | Feb 25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras Affected: before 1.36.33; 1.37.00 before 1.37.33 |
| CVE-2023-26035 | 9.8 | Feb 25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras Affected: before 1.36.33; 1.37.00 before 1.37.33 |
| CVE-2022-29806 | 9.8 | Apr 26 | ZoneMinder before 1.36.13 allows remote code execution via an invalid language Affected: before 1.36.13 |
| CVE-2019-8429 | 9.8 | Feb 18 | ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter Affected: before 1.32.3 |
| CVE-2019-8423 | 9.8 | Feb 18 | ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter Affected: through 1.32.3 |
| CVE-2019-8424 | 9.8 | Feb 18 | ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter Affected: before 1.32.3 |
| CVE-2019-8427 | 9.8 | Feb 18 | daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters Affected: before 1.32.3 |
| CVE-2019-8428 | 9.8 | Feb 18 | ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroup[MonitorIds][] value Affected: before 1.32.3 |
| CVE-2019-6991 | 9.8 | Jan 28 | A classic Stack-based buffer overflow exists in the zmLoadUser() function in zm_user.cpp of the zmu binary in ZoneMinder through 1.32.3, allowing an unauthenticated attacker to… Affected: through 1.32.3 |
| CVE-2018-1000833 | 9.8 | Dec 20 | ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF,… Affected: through 1.32.2 |
| CVE-2018-1000832 | 9.8 | Dec 20 | ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF,… Affected: through 1.32.2 |
| CVE-2016-10204 | 9.8 | Mar 3 | SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php Affected: through 1.30.0 |
| CVE-2026-102608 | 9.0 | Oct 16 | ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php) Affected: >= 1.37.48, < 1.38.3 |
Showing 17