CVE-2026-72556 | High | 8.8 | 2026-08-11 | A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the… |
CVE-2026-27470 | High | 8.8 | 2026-02-21 | ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-o… |
CVE-2025-65791 | Critical | 9.8 | 2026-02-18 | ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. N… |
CVE-2024-51482 | Critical | 9.9 | 2024-10-31 | ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* <= 1.37.64 is vulnerable to boolean-based SQL Injection in… |
CVE-2023-31493 | Medium | 6.6 | 2024-10-15 | RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted pa… |
CVE-2024-43360 | Critical | 9.8 | 2024-08-12 | ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vuln… |
CVE-2024-43359 | Unrated | | 2024-08-12 | ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the montagereview via… |
CVE-2024-43358 | Medium | 6.1 | 2024-08-12 | ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the filter view via th… |
CVE-2023-41884 | High | 7.1 | 2024-08-12 | ZoneMinder is a free, open source Closed-circuit television software application. In WWW/AJAX/watch.php, Line: 51 takes a few parameter in sql query without sa… |
CVE-2020-25730 | High | 8.2 | 2024-04-04 | Cross Site Scripting (XSS) vulnerability in ZoneMinder before version 1.34.21, allows remote attackers execute arbitrary code, escalate privileges, and obtain… |
CVE-2023-26039 | High | 7.1 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-26038 | Medium | 5.4 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-26037 | High | 8.9 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-26036 | High | 8.1 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-26035 | High | 7.2 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-26034 | Critical | 9.6 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-26032 | High | 8.9 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-25825 | High | 7.7 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2022-30769 | Medium | 4.6 | 2022-11-15 | Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user. |
CVE-2022-30768 | Medium | 5.4 | 2022-11-15 | A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field when an Admin (or… |
CVE-2022-39291 | Medium | 5.4 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows u… |
CVE-2022-39290 | High | 8.0 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application. In affected versions authenticated users can bypass CSRF keys by modifying th… |
CVE-2022-39289 | Critical | 9.1 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user… |
CVE-2022-39285 | High | 7.6 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS)… |
CVE-2022-29806 | Critical | 9.8 | 2022-04-26 | ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to expl… |
CVE-2020-25729 | Medium | 6.1 | 2020-09-17 | ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php. |
CVE-2019-13072 | Medium | 5.4 | 2019-06-30 | Stored XSS in the Filters page (Name field) in ZoneMinder 1.32.3 allows a malicious user to embed and execute JavaScript code in the browser of any user who na… |
CVE-2019-8429 | Critical | 9.8 | 2019-02-18 | ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter. |
CVE-2019-8428 | Critical | 9.8 | 2019-02-18 | ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroup[MonitorIds][] value. |
CVE-2019-8427 | Critical | 9.8 | 2019-02-18 | daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters. |
CVE-2019-8426 | Medium | 6.1 | 2019-02-18 | skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControl[MinTiltRange] parameter. |
CVE-2019-8425 | Medium | 6.1 | 2019-02-18 | includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages. |
CVE-2019-8424 | Critical | 9.8 | 2019-02-18 | ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter. |
CVE-2019-8423 | Critical | 9.8 | 2019-02-18 | ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter. |
CVE-2019-7352 | Medium | 6.1 | 2019-02-04 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'state' (aka Run State) (state.php) does no input validation to the v… |
CVE-2019-7351 | Medium | 6.5 | 2019-02-04 | Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom L… |
CVE-2019-7350 | High | 7.3 | 2019-02-04 | Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victi… |
CVE-2019-7349 | Medium | 6.1 | 2019-02-04 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitor[… |
CVE-2019-7348 | Medium | 6.1 | 2019-02-04 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'usernam… |
CVE-2019-7347 | High | 7.5 | 2019-02-04 | A Time-of-check Time-of-use (TOCTOU) Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deleti… |
CVE-2019-7346 | High | 8.8 | 2019-02-04 | A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback function is called displaying a "Try again" button, which all… |
CVE-2019-7345 | Medium | 4.8 | 2019-02-04 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'options' (options.php) does no input validation for the WEB_TITLE, H… |
CVE-2019-7344 | Medium | 6.1 | 2019-02-04 | Reflected XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'filter' as it insecurely prints the 'fi… |
CVE-2019-7343 | Medium | 6.1 | 2019-02-04 | Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonito… |
CVE-2019-7342 | Medium | 6.1 | 2019-02-04 | POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filter[AutoExe… |
CVE-2019-7341 | Medium | 6.1 | 2019-02-04 | Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonito… |
CVE-2019-7340 | Medium | 6.1 | 2019-02-04 | POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filter[Query][… |
CVE-2019-7339 | Medium | 6.1 | 2019-02-04 | POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'level' paramet… |
CVE-2019-7338 | Medium | 6.1 | 2019-02-04 | Self - Stored XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'group' as it insecurely prints the… |
CVE-2019-7337 | Medium | 4.8 | 2019-02-04 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value, witho… |
CVE-2019-7336 | Medium | 6.1 | 2019-02-04 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view _monitor_filters.php contains takes in input from the user and saves… |
CVE-2019-7335 | Medium | 6.1 | 2019-02-04 | Self - Stored XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'log' as it insecurely prints the 'L… |
CVE-2019-7334 | Medium | 6.1 | 2019-02-04 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile'… |
CVE-2019-7333 | Medium | 6.1 | 2019-02-04 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile'… |
CVE-2019-7332 | Medium | 6.1 | 2019-02-04 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'eid' (aka E… |
CVE-2019-7331 | Medium | 6.1 | 2019-02-04 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 while editing an existing monitor field named "signal check color" (monitor.php)… |
CVE-2019-7330 | Medium | 6.1 | 2019-02-04 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'show' param… |
CVE-2019-7329 | Medium | 6.1 | 2019-02-04 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the form action on multiple views utilizes $_SERVER['PHP_SELF'] insecurely, mishan… |
CVE-2019-7328 | Medium | 6.1 | 2019-02-04 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'scale' para… |
CVE-2019-7327 | Medium | 6.1 | 2019-02-04 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'scale' para… |
CVE-2019-7326 | Medium | 6.1 | 2019-02-04 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Host' p… |
CVE-2019-7325 | Medium | 6.1 | 2019-02-04 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as multiple views under web/skins/classic/views insecurely utilize $_REQUEST['PHP_SEL… |
CVE-2019-6992 | Medium | 6.1 | 2019-01-28 | A stored-self XSS exists in web/skins/classic/views/controlcaps.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a… |
CVE-2019-6991 | Critical | 9.8 | 2019-01-28 | A classic Stack-based buffer overflow exists in the zmLoadUser() function in zm_user.cpp of the zmu binary in ZoneMinder through 1.32.3, allowing an unauthenti… |
CVE-2019-6990 | Medium | 5.4 | 2019-01-28 | A stored-self XSS exists in web/skins/classic/views/zones.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulner… |
CVE-2019-6777 | Medium | 6.1 | 2019-01-24 | An issue was discovered in ZoneMinder v1.32.3. Reflected XSS exists in web/skins/classic/views/plugin.php via the zm/index.php?view=plugin pl parameter. |
CVE-2018-1000833 | Critical | 9.8 | 2018-12-20 | ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of… |
CVE-2018-1000832 | Critical | 9.8 | 2018-12-20 | ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of… |
CVE-2017-7203 | Medium | 6.1 | 2017-03-21 | A Cross-Site Scripting (XSS) was discovered in ZoneMinder before 1.30.2. The vulnerability exists due to insufficient filtration of user-supplied data (postLog… |
CVE-2016-10206 | High | 8.8 | 2017-03-03 | Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that… |
CVE-2016-10205 | High | 7.3 | 2017-03-03 | Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie. |
CVE-2016-10204 | Critical | 9.8 | 2017-03-03 | SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query req… |
CVE-2016-10203 | Medium | 6.1 | 2017-03-03 | Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the name when creati… |
CVE-2016-10202 | Medium | 6.1 | 2017-03-03 | Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the path info to ind… |
CVE-2016-10201 | Medium | 6.1 | 2017-03-03 | Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter… |
CVE-2017-5595 | Medium | 5.5 | 2017-02-06 | A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to r… |
CVE-2017-5368 | High | 8.8 | 2017-02-06 | ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF (Cross Site Request Forgery) which allows a remote attack to make… |
CVE-2017-5367 | Medium | 6.1 | 2017-02-06 | Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, w… |
CVE-2016-10140 | High | 7.5 | 2017-01-13 | Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which al… |
CVE-2013-0332 | | | 2013-03-20 | Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) vi… |
CVE-2013-0232 | | | 2013-03-20 | includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in… |
CVE-2008-6756 | | | 2009-04-27 | ZoneMinder 1.23.3 on Gentoo Linux uses 0644 permissions for /etc/zm.conf, which allows local users to obtain the database username and password by reading this… |
CVE-2008-6755 | | | 2009-04-27 | ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remot… |
CVE-2008-3882 | | | 2008-09-02 | Unspecified "Command Injection" vulnerability in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary commands via (1) the executeFilter… |
CVE-2008-3881 | | | 2008-09-02 | Multiple cross-site scripting (XSS) vulnerabilities in ZoneMinder 1.23.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecif… |
CVE-2008-3880 | | | 2008-09-02 | SQL injection vulnerability in zm_html_view_event.php in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary SQL commands via the filter… |
CVE-2008-1381 | | | 2008-05-01 | ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated attackers in some installations, to execute arbitrary commands via she… |