ZoneMinder

Records96All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical20CVSS 9.0–10.0

CVSS high24CVSS 7.0–8.9

Exploited now

ZoneMinder records in CISA KEV

No ZoneMinder vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Zoneminder 85 records HIGH

Records

85 records in Zoneminder · all components

TI-2025-40444 CVE-2025-65791 · GHSA-xw73-fccw-fgc4

ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php.

HIGH 82

ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01819 Published 2026-02-18 No fix listed CWE-78

TI-2023-11269 CVE-2023-26035

ZoneMinder vulnerable to Missing Authorization

HIGH 82

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.80462 Published 2023-02-25 Fixed in 1.36.33, 1.37.33 CWE-862

TI-2022-18665 CVE-2022-39289

Database log access in ZoneMinder

HIGH 80

ZoneMinder is a free, open source Closed-circuit television software application.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00955 Published 2022-10-07 Fixed in 1.36.27, 1.37.24 CWE-200

TI-2022-12167 CVE-2022-29806 · GHSA-xr7v-8xc4-62vc

ZoneMinder before 1.36.13 allows remote code execution via an invalid language.

HIGH 79

ZoneMinder before 1.36.13 allows remote code execution via an invalid language.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.67128 Published 2022-04-26 No fix listed CWE-22

TI-2024-29012 CVE-2024-43360

ZoneMinder Time-based SQL Injection

HIGH 76

ZoneMinder is a free, open source closed-circuit television software application.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06171 Published 2024-08-12 Fixed in 1.36.34, 1.37.61 CWE-89

TI-2023-11270 CVE-2023-26036

ZoneMinder contains Local File Inclusion vulnerability

HIGH 76

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00897 Published 2023-02-25 Fixed in 1.36.33, 1.37.33 CWE-426

TI-2023-11268 CVE-2023-26034

ZoneMinder SQL Injection

HIGH 76

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.01592 Published 2023-02-25 Fixed in 1.36.33, 1.37.33 CWE-89

TI-2026-21877 CVE-2026-27470

ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields

HIGH 73

ZoneMinder is a free, open source closed-circuit television software application.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00534 Published 2026-02-21 Fixed in 1.36.38, 1.38.1 CWE-89

TI-2022-18666 CVE-2022-39290

CSRF key bypass using HTTP methods in zoneminder

HIGH 70

ZoneMinder is a free, open source Closed-circuit television software application.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.07918 Published 2022-10-07 Fixed in 1.36.27, 1.37.24 CWE-287

TI-2023-11095 CVE-2023-25825

ZoneMinder contains Cross-site Scripting via log viewing

HIGH 67

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.0071 Published 2023-02-25 Fixed in 1.36.33 CWE-79

TI-2022-18661 CVE-2022-39285

Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder

HIGH 66

ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.05123 Published 2022-10-07 Fixed in 1.36.27, 1.37.24 CWE-79

TI-2023-22276 CVE-2023-41884

ZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.php

MEDIUM 64

ZoneMinder is a free, open source Closed-circuit television software application.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00508 Published 2024-08-12 Fixed in 1.36.34 CWE-89

TI-2023-15098 CVE-2023-31493

RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can…

MEDIUM 64

RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted payload and escalate privileges allowing execution of any comma…

CVSS 3.1MEDIUM 6.6 Local Low privileges No interaction EPSS 0.00488 Published 2024-10-15 No fix listed CWE-94

TI-2013-00166 CVE-2013-0232 · GHSA-c4jr-gf6w-2x72

includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows…

MEDIUM 63

includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; o…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.47895 Published 2013-03-20 No fix listed

TI-2023-11272 CVE-2023-26038

ZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php`

MEDIUM 62

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0051 Published 2023-02-25 Fixed in 1.36.33, 1.37.33 CWE-426

TI-2022-18667 CVE-2022-39291

Denial of service through logs in zoneminder

MEDIUM 58

ZoneMinder is a free, open source Closed-circuit television software application.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.07106 Published 2022-10-07 Fixed in 1.36.27, 1.37.24 CWE-20

TI-2022-12899 CVE-2022-30768 · GHSA-mjxc-g8h2-2g9g

A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to…

MEDIUM 58

A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field when an Admin (or non-Admin users that can see other users logged into the plat…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00631 Published 2022-11-15 No fix listed CWE-79

TI-2022-12900 CVE-2022-30769 · GHSA-7jhg-5532-mghv

Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session…

MEDIUM 54

Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00517 Published 2022-11-15 No fix listed CWE-384

TI-2018-16054 CVE-2018-1000832 · GHSA-5h2c-x34m-pf7p

ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled…

MEDIUM 52

ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.06598 Published 2018-12-20 No fix listed CWE-502

TI-2008-03721 CVE-2008-3882 · GHSA-cvgp-9gf8-257q

Unspecified "Command Injection" vulnerability in ZoneMinder 1.23.3 and earlier allows…

MEDIUM 49

Unspecified "Command Injection" vulnerability in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary commands via (1) the executeFilter function in zm_html_view_events.php and (2) the run_state par…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03481 Published 2008-09-02 No fix listed CWE-94

TI-2019-04926 CVE-2019-6991 · GHSA-j63x-h9vw-pgh3

A classic Stack-based buffer overflow exists in the zmLoadUser() function in zm_user.cpp…

MEDIUM 48

A classic Stack-based buffer overflow exists in the zmLoadUser() function in zm_user.cpp of the zmu binary in ZoneMinder through 1.32.3, allowing an unauthenticated attacker to execute code via a long username.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03309 Published 2019-01-28 No fix listed CWE-787

TI-2018-16055 CVE-2018-1000833 · GHSA-gf3j-qpxp-849p

ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled…

MEDIUM 48

ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03232 Published 2018-12-20 No fix listed CWE-502

TI-2019-06046 CVE-2019-8427 · GHSA-r8rh-cw28-gx6w

daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters.

MEDIUM 47

daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02791 Published 2019-02-18 No fix listed CWE-78

TI-2019-06048 CVE-2019-8429 · GHSA-2crj-4cj6-f7cw

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter.

MEDIUM 46

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01844 Published 2019-02-18 No fix listed CWE-89

TI-2016-08280 CVE-2016-10204 · GHSA-rrv5-j728-p424

SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to…

MEDIUM 46

SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02082 Published 2017-03-03 No fix listed CWE-89

Open these records in search →