What is CVE-2023-41884?

CVE-2023-41884 is a high-severity vulnerability in Zoneminder, classified under SQL Injection. CVSS score: 7.1/10. Published 2024-08-12.

How severe is CVE-2023-41884?

High severity. CVSS v3 base score is 7.1 out of 10.

SQL Injection in Zoneminder

CVE-2023-41884

ZoneMinder is a free, open source Closed-circuit television software application. In WWW/AJAX/watch.php, Line: 51 takes a few parameter in sql query without sanitizing it which makes it vulnerable to sql injection. This vulnerability is fixed in 1.36.34.

Vulnerability class: SQL Injection

Published 2024-08-12 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.

EPSS exploit prediction

EPSS: 0.005 (41.1th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 41st percentile — 41.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: +0.000

Affected products

Zoneminder — versions < 1.36.34

Weakness classification (CWE)

CWE-89 — SQL Injection

References

github.com/ZoneMinder/zoneminder/security/advisories/GHSA-2qp3-fwpv-mc96 (Exploit, Third Party Advisory)
github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a (Patch)
github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6 (Patch)

Frequently asked questions

What is CVE-2023-41884?: CVE-2023-41884 is a high-severity vulnerability in Zoneminder, classified under SQL Injection. CVSS score: 7.1/10. Published 2024-08-12.
How severe is CVE-2023-41884?: High severity. CVSS v3 base score is 7.1 out of 10.