ZoneMinder

Records96All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical20CVSS 9.0–10.0

CVSS high24CVSS 7.0–8.9

Exploited now

ZoneMinder records in CISA KEV

No ZoneMinder vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Zoneminder 85 records HIGH

Records

96 records

TI-2025-40444 CVE-2025-65791 · GHSA-xw73-fccw-fgc4

ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php.

HIGH 82

ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01819 Published 2026-02-18 No fix listed CWE-78

TI-2023-11269 CVE-2023-26035

ZoneMinder vulnerable to Missing Authorization

HIGH 82

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.80462 Published 2023-02-25 Fixed in 1.36.33, 1.37.33 CWE-862

TI-2022-18665 CVE-2022-39289

Database log access in ZoneMinder

HIGH 80

ZoneMinder is a free, open source Closed-circuit television software application.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00955 Published 2022-10-07 Fixed in 1.36.27, 1.37.24 CWE-200

TI-2022-12167 CVE-2022-29806 · GHSA-xr7v-8xc4-62vc

ZoneMinder before 1.36.13 allows remote code execution via an invalid language.

HIGH 79

ZoneMinder before 1.36.13 allows remote code execution via an invalid language.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.67128 Published 2022-04-26 No fix listed CWE-22

TI-2024-34403 CVE-2024-51482

Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64

HIGH 76

ZoneMinder is a free, open source closed-circuit television software application.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.3661 Published 2024-10-31 Fixed in 1.37.65 CWE-89

TI-2024-29012 CVE-2024-43360

ZoneMinder Time-based SQL Injection

HIGH 76

ZoneMinder is a free, open source closed-circuit television software application.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06171 Published 2024-08-12 Fixed in 1.36.34, 1.37.61 CWE-89

TI-2023-11270 CVE-2023-26036

ZoneMinder contains Local File Inclusion vulnerability

HIGH 76

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00897 Published 2023-02-25 Fixed in 1.36.33, 1.37.33 CWE-426

TI-2023-11268 CVE-2023-26034

ZoneMinder SQL Injection

HIGH 76

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.01592 Published 2023-02-25 Fixed in 1.36.33, 1.37.33 CWE-89

TI-2026-75998 CVE-2026-102607

OS command injection in ZoneMinder export allows code execution

HIGH 73

ZoneMinder is a free, open source closed-circuit television software application.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00447 Published 2026-10-16 Fixed in 1.38.2 CWE-78

TI-2026-75523 CVE-2026-30971

Command injection in ZoneMinder Device Path allows code execution

HIGH 73

ZoneMinder is a free, open source closed-circuit television software application.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01065 Published 2026-10-16 Fixed in 1.36.40, 1.38.2 +1 CWE-78

TI-2026-21877 CVE-2026-27470

ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields

HIGH 73

ZoneMinder is a free, open source closed-circuit television software application.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00534 Published 2026-02-21 Fixed in 1.36.38, 1.38.1 CWE-89

TI-2022-18666 CVE-2022-39290

CSRF key bypass using HTTP methods in zoneminder

HIGH 70

ZoneMinder is a free, open source Closed-circuit television software application.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.07918 Published 2022-10-07 Fixed in 1.36.27, 1.37.24 CWE-287

TI-2026-65320 CVE-2026-102296 · GHSA-9748-j7v2-wg49

ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response

HIGH 69

ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized…

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00439 Published 2026-09-28 Fixed in 1.38.4 CWE-120

TI-2023-11095 CVE-2023-25825

ZoneMinder contains Cross-site Scripting via log viewing

HIGH 67

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.0071 Published 2023-02-25 Fixed in 1.36.33 CWE-79

TI-2022-18661 CVE-2022-39285

Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder

HIGH 66

ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.05123 Published 2022-10-07 Fixed in 1.36.27, 1.37.24 CWE-79

TI-2023-22276 CVE-2023-41884

ZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.php

MEDIUM 64

ZoneMinder is a free, open source Closed-circuit television software application.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00508 Published 2024-08-12 Fixed in 1.36.34 CWE-89

TI-2023-15098 CVE-2023-31493

RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can…

MEDIUM 64

RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted payload and escalate privileges allowing execution of any comma…

CVSS 3.1MEDIUM 6.6 Local Low privileges No interaction EPSS 0.00488 Published 2024-10-15 No fix listed CWE-94

TI-2026-74996 CVE-2026-104198

ZoneMinder failed token handling bypasses web authentication

MEDIUM 63

ZoneMinder is a free, open source closed-circuit television software application.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00386 Published 2026-10-15 Fixed in 1.36.63 CWE-287

TI-2013-00166 CVE-2013-0232 · GHSA-c4jr-gf6w-2x72

includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows…

MEDIUM 63

includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; o…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.47895 Published 2013-03-20 No fix listed

TI-2026-39158 CVE-2026-54258

Cross-monitor event media authorization bypass in direct event media endpoints

MEDIUM 62

ZoneMinder is a free, open source closed-circuit television software application.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0034 Published 2026-09-11 Fixed in 1.36.39, 1.38.4 +1 CWE-639

TI-2023-11272 CVE-2023-26038

ZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php`

MEDIUM 62

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0051 Published 2023-02-25 Fixed in 1.36.33, 1.37.33 CWE-426

TI-2022-18667 CVE-2022-39291

Denial of service through logs in zoneminder

MEDIUM 58

ZoneMinder is a free, open source Closed-circuit television software application.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.07106 Published 2022-10-07 Fixed in 1.36.27, 1.37.24 CWE-20

TI-2022-12899 CVE-2022-30768 · GHSA-mjxc-g8h2-2g9g

A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to…

MEDIUM 58

A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field when an Admin (or non-Admin users that can see other users logged into the plat…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00631 Published 2022-11-15 No fix listed CWE-79

TI-2026-65321 CVE-2026-102297 · GHSA-xfq3-f9p9-wv2c

ZoneMinder before 1.38.4 Incorrect Authorization in frames API index

MEDIUM 57

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0028 Published 2026-09-28 Fixed in 1.38.4 CWE-863

TI-2022-12900 CVE-2022-30769 · GHSA-7jhg-5532-mghv

Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session…

MEDIUM 54

Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00517 Published 2022-11-15 No fix listed CWE-384

Open these records in search →