Zabbix
116 CVEs across 12 Zabbix products. Browse Zabbix vulnerabilities, severities, and proof-of-concept exploits.
Zabbix products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-23928 | | 2026-05-06 | The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow… | |
CVE-2026-23927 | | 2026-05-06 | A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-co… | |
CVE-2026-23926 | | 2026-05-06 | An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that m… | |
CVE-2026-23924 | | 2026-03-24 | Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable o… | |
CVE-2026-23923 | | 2026-03-24 | An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup bu… | |
CVE-2026-23921 | | 2026-03-24 | A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL sel… | |
CVE-2026-23920 | | 2026-03-24 | Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used… | |
CVE-2026-23919 | | 2026-03-24 | For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to co… | |
CVE-2026-23925 | High | 8.1 | 2026-03-06 | An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to conf… |
CVE-2025-49643 | Medium | 6.5 | 2025-12-01 | An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore… |
CVE-2025-49642 | | 2025-12-01 | Library loading on AIX Zabbix Agent builds can be hijacked by local users with write access to the /home/cecuser directory. | |
CVE-2025-27232 | Medium | 4.9 | 2025-12-01 | An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss. |
CVE-2025-49641 | Medium | 4.3 | 2025-10-03 | A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve… |
CVE-2025-27237 | | 2025-10-03 | In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification… | |
CVE-2025-27236 | Medium | 6.5 | 2025-10-03 | A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining… |
CVE-2025-27231 | Medium | 4.9 | 2025-10-03 | The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate t… |
CVE-2025-27240 | High | 7.2 | 2025-09-12 | A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field. |
CVE-2025-27238 | Low | 3.5 | 2025-09-12 | Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them. |
CVE-2025-27234 | | 2025-09-12 | Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl comm… | |
CVE-2025-27233 | | 2025-09-12 | Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl comm… | |
CVE-2024-45700 | Medium | 6.5 | 2025-04-02 | Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, whic… |
CVE-2024-45699 | Medium | 5.4 | 2025-04-02 | The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection… |
CVE-2024-42325 | Low | 3.5 | 2025-04-02 | Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc. |
CVE-2024-36469 | Low | 3.1 | 2025-04-02 | Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one. |
CVE-2024-36465 | High | 8.8 | 2025-04-02 | A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL comma… |
CVE-2024-36466 | High | 8.8 | 2024-11-28 | A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions. |
CVE-2024-36464 | Low | 2.7 | 2024-11-27 | When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. T… |
CVE-2024-42333 | Low | 2.7 | 2024-11-27 | The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c |
CVE-2024-42332 | Low | 3.7 | 2024-11-27 | The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have for… |
CVE-2024-42331 | Low | 3.3 | 2024-11-27 | In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequen… |
CVE-2024-42330 | Critical | 9.1 | 2024-11-27 | The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are create… |
CVE-2024-42329 | Low | 3.3 | 2024-11-27 | The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this function can fail for… |
CVE-2024-42328 | Low | 3.3 | 2024-11-27 | When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiv… |
CVE-2024-42327 | Critical | 9.9 | 2024-11-27 | A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQL… |
CVE-2024-42326 | Medium | 4.4 | 2024-11-27 | There was discovered a use after free bug in browser.c in the es_browser_get_variant function |
CVE-2024-36468 | Low | 3.0 | 2024-11-27 | The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code. This issue occurs whe… |
CVE-2024-36467 | High | 7.5 | 2024-11-27 | An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be… |
CVE-2024-36463 | Medium | 6.5 | 2024-11-26 | The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects. |
CVE-2024-22117 | Low | 2.2 | 2024-11-26 | When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementu… |
CVE-2024-36462 | High | 7.5 | 2024-08-12 | Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandw… |
CVE-2024-36461 | Critical | 9.1 | 2024-08-12 | Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine. |
CVE-2024-36460 | High | 8.1 | 2024-08-12 | The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text. |
CVE-2024-22123 | Low | 2.7 | 2024-08-12 | Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another… |
CVE-2024-22122 | Low | 3.0 | 2024-08-12 | Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zab… |
CVE-2024-22121 | Medium | 6.1 | 2024-08-12 | A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application. |
CVE-2024-22116 | Critical | 9.9 | 2024-08-12 | An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping f… |
CVE-2024-22114 | Medium | 4.3 | 2024-08-12 | User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard. |
CVE-2024-22120 | Critical | 9.1 | 2024-05-17 | Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is… |
CVE-2024-22119 | Medium | 5.5 | 2024-02-09 | The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section. |
CVE-2023-32728 | Medium | 4.6 | 2023-12-18 | The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote… |
CVE-2023-32727 | Medium | 6.8 | 2023-12-18 | An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code o… |
CVE-2023-32726 | Low | 3.9 | 2023-12-18 | The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server. |
CVE-2023-32725 | Critical | 9.6 | 2023-12-18 | The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be use… |
CVE-2023-32724 | Critical | 9.1 | 2023-10-12 | Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation. |
CVE-2023-32723 | High | 8.5 | 2023-10-12 | Request to LDAP is sent before user permissions are checked. |
CVE-2023-32722 | Critical | 9.6 | 2023-10-12 | The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open. |
CVE-2023-32721 | High | 7.6 | 2023-10-12 | A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. |
CVE-2023-29453 | Critical | 9.8 | 2023-10-12 | Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS tem… |
CVE-2023-30958 | Medium | 4.7 | 2023-08-03 | A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. This defe… |
CVE-2023-29458 | Medium | 5.9 | 2023-07-13 | Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript wil… |
CVE-2023-29457 | Medium | 6.3 | 2023-07-13 | Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action for… |
CVE-2023-29456 | Medium | 5.7 | 2023-07-13 | URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL component… |
CVE-2023-29455 | Medium | 5.4 | 2023-07-13 | Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The scri… |
CVE-2023-29454 | Medium | 5.4 | 2023-07-13 | Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves… |
CVE-2023-29452 | Medium | 5.5 | 2023-07-13 | Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile… |
CVE-2023-29451 | Medium | 4.7 | 2023-07-13 | Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy. |
CVE-2023-29450 | High | 8.5 | 2023-07-13 | JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Z… |
CVE-2023-29449 | Medium | 5.9 | 2023-07-13 | JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configu… |
CVE-2022-46768 | Medium | 5.9 | 2022-12-15 | Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation… |
CVE-2022-43516 | Medium | 6.5 | 2022-12-05 | A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent in… |
CVE-2022-43515 | Medium | 5.3 | 2022-12-05 | Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any us… |
CVE-2022-40626 | Medium | 4.8 | 2022-09-14 | An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to crea… |
CVE-2022-35230 | Low | 3.7 | 2022-07-06 | An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed on… |
CVE-2022-35229 | Low | 3.7 | 2022-07-06 | An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed… |
CVE-2022-24919 | Low | 3.7 | 2022-03-09 | An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only… |
CVE-2022-24918 | Low | 3.7 | 2022-03-09 | An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only w… |
CVE-2022-24917 | Low | 3.7 | 2022-03-09 | An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed onl… |
CVE-2022-24349 | Medium | 4.6 | 2022-03-09 | An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same ob… |
CVE-2021-46088 | High | 7.2 | 2022-01-27 | Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the "Zabbix Admin" role is able to run custom shell script on… |
CVE-2022-23134 | Low | 3.7 | 2022-01-13 | After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious a… |
CVE-2022-23133 | Medium | 6.3 | 2022-01-13 | An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authe… |
CVE-2022-23132 | Low | 3.3 | 2022-01-13 | During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or S… |
CVE-2022-23131 | Critical | 9.1 | 2022-01-13 | In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login st… |
CVE-2022-22704 | Critical | 9.8 | 2022-01-06 | The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expected that systemd w… |
CVE-2021-27927 | High | 8.8 | 2021-03-03 | In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpd… |
CVE-2020-11800 | Critical | 9.8 | 2020-10-07 | Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code. |
CVE-2020-15803 | Medium | 6.1 | 2020-07-17 | Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget. |
CVE-2013-3738 | Critical | 9.8 | 2020-02-17 | A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequate sanitization of request strings in CGI scripts, which could let a remote malicious user… |
CVE-2013-3628 | High | 8.8 | 2020-02-07 | Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability |
CVE-2013-5743 | Critical | 9.8 | 2019-12-11 | Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7. |
CVE-2013-7484 | High | 7.5 | 2019-11-30 | Zabbix before 5.0 represents passwords in the users table with unsalted MD5. |
CVE-2019-17382 | Critical | 9.1 | 2019-10-09 | An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard… |
CVE-2019-15132 | Medium | 5.3 | 2019-08-17 | Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server r… |
CVE-2016-10742 | Medium | 6.1 | 2019-02-17 | Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request param… |
CVE-2017-2825 | High | 7.0 | 2018-04-20 | In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic checks, resulting in database writes. An atta… |
CVE-2017-2826 | Low | 3.7 | 2018-04-09 | An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X. A specially crafted iConfig proxy request can cause the Zab… |
CVE-2014-3005 | Critical | 9.8 | 2018-02-01 | XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote a… |
CVE-2017-2824 | High | 8.1 | 2017-05-24 | An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a… |
CVE-2016-10134 | Critical | 9.8 | 2017-02-17 | SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array par… |
CVE-2016-4338 | High | 8.1 | 2017-01-23 | The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, whe… |