Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
192 vulnerabilities by ZoneMinder
CVE-2026-30971 (GCVE-0-2026-30971)
Vulnerability from nvd – Published: 2026-10-16 19:40 – Updated: 2026-10-16 19:57
VLAI
EPSS
VEX
Title
ZoneMinder: Authenticated RCE via command injection in monitor Device Path
Summary
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:56 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/security… | x_refsource_CONFIRM |
| https://github.com/ZoneMinder/zoneminder/commit/4… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
< 1.36.40
Affected: >= 1.38.0, < 1.38.2 Affected: >= 1.39.0, < 1.39.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-30971",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:56:46.321699Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:57:11.752Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-g66m-77fq-79v9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"status": "affected",
"version": "\u003c 1.36.40"
},
{
"status": "affected",
"version": "\u003e= 1.38.0, \u003c 1.38.2"
},
{
"status": "affected",
"version": "\u003e= 1.39.0, \u003c 1.39.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:40:51.681Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-g66m-77fq-79v9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-g66m-77fq-79v9"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/419846c8750c3f45b9b8a1df8cd49c189a14dc03",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/419846c8750c3f45b9b8a1df8cd49c189a14dc03"
}
],
"source": {
"advisory": "GHSA-g66m-77fq-79v9",
"discovery": "UNKNOWN"
},
"title": "ZoneMinder: Authenticated RCE via command injection in monitor Device Path"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-30971",
"datePublished": "2026-10-16T19:40:51.681Z",
"dateReserved": "2026-03-07T17:53:48.815Z",
"dateUpdated": "2026-10-16T19:57:11.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102608 (GCVE-0-2026-102608)
Vulnerability from nvd – Published: 2026-10-16 19:35 – Updated: 2026-10-19 16:41
VLAI
EPSS
VEX
Title
ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)
Summary
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.
Severity
9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:41 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/security… | x_refsource_CONFIRM |
| https://github.com/ZoneMinder/zoneminder/commit/2… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/b… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/b… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/releases… | x_refsource_MISC |
| https://www.scriptkittens.com/blog/two-sinks-one-shell | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
>= 1.37.48, < 1.38.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102608",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:41:30.335802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:41:08.186Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.37.48, \u003c 1.38.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor\u0027s events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:35:36.862Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/2de2ae44a1d751bad4b020c5573b2d58c59c1525",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/2de2ae44a1d751bad4b020c5573b2d58c59c1525"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/b3a7c05f079c87badf4b0ce052da0acfd4047a4b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/b3a7c05f079c87badf4b0ce052da0acfd4047a4b"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/b5605e01c14354fc8e2dcae8cefd90c3674880d9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/b5605e01c14354fc8e2dcae8cefd90c3674880d9"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.3"
},
{
"name": "https://www.scriptkittens.com/blog/two-sinks-one-shell",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.scriptkittens.com/blog/two-sinks-one-shell"
}
],
"source": {
"advisory": "GHSA-88m4-hrgp-m9v3",
"discovery": "UNKNOWN"
},
"title": "ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102608",
"datePublished": "2026-10-16T19:35:36.862Z",
"dateReserved": "2026-09-29T14:18:02.921Z",
"dateUpdated": "2026-10-19T16:41:08.186Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102607 (GCVE-0-2026-102607)
Vulnerability from nvd – Published: 2026-10-16 19:29 – Updated: 2026-10-19 14:26
VLAI
EPSS
VEX
Title
ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
Summary
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 14:25 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/security… | x_refsource_CONFIRM |
| https://github.com/ZoneMinder/zoneminder/commit/5… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/6… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
< 1.38.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102607",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T14:25:03.645262Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T14:26:23.072Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-7j62-cjxp-3cj5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"status": "affected",
"version": "\u003c 1.38.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:29:58.131Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-7j62-cjxp-3cj5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-7j62-cjxp-3cj5"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/548ed87d47a49c17b4c842f6fee8a08660deb427",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/548ed87d47a49c17b4c842f6fee8a08660deb427"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/605f962b7b6ba7f5780b3e6715b5418b8b2addca",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/605f962b7b6ba7f5780b3e6715b5418b8b2addca"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.3"
}
],
"source": {
"advisory": "GHSA-7j62-cjxp-3cj5",
"discovery": "UNKNOWN"
},
"title": "ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102607",
"datePublished": "2026-10-16T19:29:58.131Z",
"dateReserved": "2026-09-29T14:18:02.921Z",
"dateUpdated": "2026-10-19T14:26:23.072Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104198 (GCVE-0-2026-104198)
Vulnerability from nvd – Published: 2026-10-15 19:48 – Updated: 2026-10-15 20:34
VLAI
EPSS
VEX
Title
ZoneMinder failed token handling bypasses web authentication
Summary
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken() returns false when a token is malformed or has an invalid signature, but the caller assigns that value to the global $user variable; because web/index.php tests isset($user), boolean false is treated as a present user and the normal login redirect is skipped. This can dispatch views that rely on the outer authentication gate, including the zones view, which accepts an attacker-selected monitor ID and discloses monitor and zone metadata without an independent permission check. Permission helpers receive the false user value and deny privileged operations, so unauthorized state changes have not been established. This vulnerability is fixed in version 1.36.63, where conversion to ZM\User objects causes invalid token state to fail before view dispatch. Later defense-in-depth changes explicitly leave $user unset after failed token validation and reject non-ZM\User values at the web authentication gate.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 20:34 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/security… | x_refsource_CONFIRM |
| https://github.com/ZoneMinder/zoneminder/commit/1… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/6… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/7… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/9… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/9… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/d… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
>= 1.34.0, < 1.36.63
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104198",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T20:34:15.363799Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T20:34:55.708Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.34.0, \u003c 1.36.63"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken() returns false when a token is malformed or has an invalid signature, but the caller assigns that value to the global $user variable; because web/index.php tests isset($user), boolean false is treated as a present user and the normal login redirect is skipped. This can dispatch views that rely on the outer authentication gate, including the zones view, which accepts an attacker-selected monitor ID and discloses monitor and zone metadata without an independent permission check. Permission helpers receive the false user value and deny privileged operations, so unauthorized state changes have not been established. This vulnerability is fixed in version 1.36.63, where conversion to ZM\\User objects causes invalid token state to fail before view dispatch. Later defense-in-depth changes explicitly leave $user unset after failed token validation and reject non-ZM\\User values at the web authentication gate."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-697",
"description": "CWE-697: Incorrect Comparison",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:48:52.831Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-23fj-frfw-hmcr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-23fj-frfw-hmcr"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/144a04ca4fff5fd02745ce8afc239ba5e05cf8ac",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/144a04ca4fff5fd02745ce8afc239ba5e05cf8ac"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/6b94903e634fdb46cb71a48eadccf1aa14f0c2bb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/6b94903e634fdb46cb71a48eadccf1aa14f0c2bb"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/71bb186b230dbe2aba5e2f804c36810aae892088",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/71bb186b230dbe2aba5e2f804c36810aae892088"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/95460a945ab7e5c63dc0551bdd6230a3026ceb9e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/95460a945ab7e5c63dc0551bdd6230a3026ceb9e"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/969baa38912018b502617d09e836d0bfa57d4af6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/969baa38912018b502617d09e836d0bfa57d4af6"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/d71fbb805e4695a9599498a1a2ee3b286ef41c96",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/d71fbb805e4695a9599498a1a2ee3b286ef41c96"
}
],
"source": {
"advisory": "GHSA-23fj-frfw-hmcr",
"discovery": "UNKNOWN"
},
"title": "ZoneMinder failed token handling bypasses web authentication"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-104198",
"datePublished": "2026-10-15T19:48:52.831Z",
"dateReserved": "2026-10-01T18:54:15.119Z",
"dateUpdated": "2026-10-15T20:34:55.708Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102297 (GCVE-0-2026-102297)
Vulnerability from nvd – Published: 2026-09-28 22:00 – Updated: 2026-10-06 13:36
VLAI
EPSS
VEX
Title
ZoneMinder before 1.38.4 Incorrect Authorization in frames API index
Summary
ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 18:00 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/commit/a… | patch |
| https://github.com/ZoneMinder/zoneminder | product |
| https://github.com/ZoneMinder/zoneminder/security… | vendor-advisory |
| https://github.com/ZoneMinder/zoneminder/commit/e… | patch |
| https://github.com/ZoneMinder/zoneminder/releases… | release-notes |
| https://github.com/ZoneMinder/zoneminder/blob/1.3… | technical-description |
| https://www.vulncheck.com/advisories/zoneminder-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
0 , < 1.38.4
(semver)
Unaffected: 1.38.4 (semver) cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* |
Date Public
2026-07-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102297",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T18:00:09.719698Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T18:00:24.304Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mg2g-jmfc-3w8g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/ZoneMinder/zoneminder",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ZoneMinder/zoneminder",
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"lessThan": "1.38.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.38.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.38.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "arpitjain099"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-07-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:36:53.906Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/aafe580b231bbeead12a110a957d85a26f7a23be"
},
{
"tags": [
"product"
],
"url": "https://github.com/ZoneMinder/zoneminder"
},
{
"name": "GitHub Security Advisory (GHSA-mg2g-jmfc-3w8g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mg2g-jmfc-3w8g"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/efe6c60d8798c60ab41b120dc034488388c47dda"
},
{
"name": "zoneminder 1.38.4 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.4"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ZoneMinder/zoneminder/blob/1.38.3/web/api/app/Controller/FramesController.php#L51"
},
{
"name": "VulnCheck Advisory: ZoneMinder before 1.38.4 Incorrect Authorization in frames API index",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zoneminder-before-1.38.4-incorrect-authorization-in-frames-api-index"
}
],
"title": "ZoneMinder before 1.38.4 Incorrect Authorization in frames API index",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-102297",
"datePublished": "2026-09-28T22:00:19.790Z",
"dateReserved": "2026-09-28T21:24:45.106Z",
"dateUpdated": "2026-10-06T13:36:53.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102296 (GCVE-0-2026-102296)
Vulnerability from nvd – Published: 2026-09-28 22:00 – Updated: 2026-10-06 13:36
VLAI
EPSS
VEX
Title
ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response
Summary
ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Attackers can send crafted HTTP responses with oversized status messages, Connection headers, Content-Type values, or multipart boundaries to corrupt parser state and crash the capture process or corrupt memory.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 19:44 UTC
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/commit/2… | patch |
| https://github.com/ZoneMinder/zoneminder | product |
| https://github.com/ZoneMinder/zoneminder/security… | vendor-advisory |
| https://github.com/ZoneMinder/zoneminder/commit/8… | patch |
| https://github.com/ZoneMinder/zoneminder/releases… | release-notes |
| https://github.com/ZoneMinder/zoneminder/blob/1.3… | technical-description |
| https://www.vulncheck.com/advisories/zoneminder-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
0 , < 1.38.4
(semver)
Unaffected: 1.38.4 (semver) cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* |
Date Public
2026-07-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102296",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T19:44:10.856899Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T19:44:40.922Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-93j4-rcp9-9jx6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/ZoneMinder/zoneminder",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ZoneMinder/zoneminder",
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"lessThan": "1.38.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.38.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.38.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "TristanInSec"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-07-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Attackers can send crafted HTTP responses with oversized status messages, Connection headers, Content-Type values, or multipart boundaries to corrupt parser state and crash the capture process or corrupt memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:36:53.153Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/2596e5fb64c0348e615577b0ab08dc38b6dc6ed8"
},
{
"tags": [
"product"
],
"url": "https://github.com/ZoneMinder/zoneminder"
},
{
"name": "GitHub Security Advisory (GHSA-93j4-rcp9-9jx6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-93j4-rcp9-9jx6"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/813bf6f1a3ffc92c163352f2480477ba571fca5b"
},
{
"name": "zoneminder 1.38.4 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.4"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ZoneMinder/zoneminder/blob/1.38.3/src/zm_remote_camera_http.cpp#L736"
},
{
"name": "VulnCheck Advisory: ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zoneminder-before-1.38.4-buffer-overflow-via-http-camera-response"
}
],
"title": "ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-102296",
"datePublished": "2026-09-28T22:00:19.143Z",
"dateReserved": "2026-09-28T21:24:39.616Z",
"dateUpdated": "2026-10-06T13:36:53.153Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-58386 (GCVE-0-2024-58386)
Vulnerability from nvd – Published: 2026-09-28 22:00 – Updated: 2026-10-06 13:36
VLAI
EPSS
VEX
Title
ZoneMinder 1.37.x Path Traversal via files view
Summary
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to output_file, enabling attackers with Events view permission to access sensitive files like configuration files containing database credentials.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 19:42 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/commit/3… | patch |
| https://github.com/ZoneMinder/zoneminder | product |
| https://github.com/ZoneMinder/zoneminder/security… | vendor-advisory |
| https://github.com/ZoneMinder/zoneminder/commit/0… | patch |
| https://github.com/ZoneMinder/zoneminder/issues/4472 | issue-tracking |
| https://github.com/ZoneMinder/zoneminder/releases… | release-notes |
| https://github.com/ZoneMinder/zoneminder/blob/1.3… | technical-description |
| https://www.vulncheck.com/advisories/zoneminder-1… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
1.37.0 , < 1.38.0
(semver)
cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* |
Date Public
2024-09-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-58386",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T19:42:42.975996Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T19:42:55.370Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/ZoneMinder/zoneminder",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ZoneMinder/zoneminder",
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"lessThan": "1.38.0",
"status": "affected",
"version": "1.37.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.38.0",
"versionStartIncluding": "1.37.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2024-09-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to output_file, enabling attackers with Events view permission to access sensitive files like configuration files containing database credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:36:44.922Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/3b379e99c0c1e539334ad4186c15ad0dc6c238b9"
},
{
"tags": [
"product"
],
"url": "https://github.com/ZoneMinder/zoneminder"
},
{
"name": "GitHub Security Advisory (GHSA-8fw2-wh82-vv4h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-8fw2-wh82-vv4h"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/071d968bc8ecd5c4f56a87cbe0c3063bc35dbc5d"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/ZoneMinder/zoneminder/issues/4472"
},
{
"name": "zoneminder 1.38.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ZoneMinder/zoneminder/blob/1.37.64/web/skins/classic/views/files.php#L26-L39"
},
{
"name": "VulnCheck Advisory: ZoneMinder 1.37.x Path Traversal via files view",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zoneminder-1.37-x-path-traversal-via-files-view"
}
],
"title": "ZoneMinder 1.37.x Path Traversal via files view",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-58386",
"datePublished": "2026-09-28T22:00:16.575Z",
"dateReserved": "2026-09-28T21:24:45.481Z",
"dateUpdated": "2026-10-06T13:36:44.922Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54258 (GCVE-0-2026-54258)
Vulnerability from nvd – Published: 2026-09-11 21:31 – Updated: 2026-09-15 16:50
VLAI
EPSS
VEX
Title
Cross-monitor event media authorization bypass in direct event media endpoints
Summary
ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse `Events=View` and/or `Snapshots=View` permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI correctly hides the restricted monitor and its events, but direct event media views accept an arbitrary `eid` and stream media from the event path without enforcing the event/monitor-level ACL. This exposes private surveillance footage across monitor boundaries. Versions 1.36.39, 1.38.4, and 1.39.11 fix the issue.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 16:49 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/security… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
< 1.36.39
Affected: >= 1.37.0, < 1.38.4 Affected: >= 1.39.0, < 1.39.11 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54258",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T16:49:55.325622Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T16:50:32.195Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-vj5r-pc2v-gfwv"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"status": "affected",
"version": "\u003c 1.36.39"
},
{
"status": "affected",
"version": "\u003e= 1.37.0, \u003c 1.38.4"
},
{
"status": "affected",
"version": "\u003e= 1.39.0, \u003c 1.39.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse `Events=View` and/or `Snapshots=View` permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI correctly hides the restricted monitor and its events, but direct event media views accept an arbitrary `eid` and stream media from the event path without enforcing the event/monitor-level ACL. This exposes private surveillance footage across monitor boundaries. Versions 1.36.39, 1.38.4, and 1.39.11 fix the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T21:31:30.218Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-vj5r-pc2v-gfwv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-vj5r-pc2v-gfwv"
}
],
"source": {
"advisory": "GHSA-vj5r-pc2v-gfwv",
"discovery": "UNKNOWN"
},
"title": "Cross-monitor event media authorization bypass in direct event media endpoints"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54258",
"datePublished": "2026-09-11T21:31:30.218Z",
"dateReserved": "2026-06-12T17:13:32.278Z",
"dateUpdated": "2026-09-15T16:50:32.195Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76060 (GCVE-0-2026-76060)
Vulnerability from nvd – Published: 2026-08-27 20:29 – Updated: 2026-08-28 15:58
VLAI
EPSS
VEX
Title
OS Command Injection in PayRange API
Summary
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 15:45 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zoneminder | Zoneminder |
Affected:
1.37.48 , < 1.38.3
(custom)
Unaffected: 1.38.3 |
Date Public
2026-08-25 21:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76060",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T15:45:46.658133Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T15:58:01.239Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Zoneminder",
"vendor": "Zoneminder",
"versions": [
{
"lessThan": "1.38.3",
"status": "affected",
"version": "1.37.48",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.38.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "CISA discovered a public proof of concept (PoC) as authored by Scriptkittens and reported it to Zoneminder."
}
],
"datePublic": "2026-08-25T21:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authenticated OS command injection vulnerability exists in ZoneMinder\u0027s event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP\u0027s exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server."
}
],
"value": "An authenticated OS command injection vulnerability exists in ZoneMinder\u0027s event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP\u0027s exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T20:29:05.262Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://zoneminder.com/downloads"
},
{
"url": "https://github.com/ZoneMinder/zoneminder"
},
{
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-02"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-02.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eZoneminder recommends upgrading to version 1.38.3 or later by downloading the installer for your system at: \u003ca href=\"https://zoneminder.com/downloads\"\u003ehttps://zoneminder.com/downloads\u003c/a\u003e.\u0026nbsp;\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eUsers may also get the source code from Zoneminder\u0027s Github: \u003ca href=\"https://github.com/ZoneMinder/zoneminder\"\u003ehttps://github.com/ZoneMinder/zoneminder\u003c/a\u003e.\u0026nbsp;\u003c/span\u003e\u0026nbsp;\u003c/div\u003e\u003cdiv\u003eFor more details refer to Zoneminder\u0027s security advisories at: \u003ca href=\"https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3\"\u003ehttps://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3\u003c/a\u003e.\u003c/div\u003e"
}
],
"value": "Zoneminder recommends upgrading to version 1.38.3 or later by downloading the installer for your system at: https://zoneminder.com/downloads .\u00a0\n\nUsers may also get the source code from Zoneminder\u0027s Github: https://github.com/ZoneMinder/zoneminder .\u00a0\u00a0\n\nFor more details refer to Zoneminder\u0027s security advisories at: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3 ."
}
],
"source": {
"advisory": "ICSA-26-237-02",
"discovery": "EXTERNAL"
},
"title": "OS Command Injection in PayRange API",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-76060",
"datePublished": "2026-08-27T20:29:05.262Z",
"dateReserved": "2026-08-18T20:49:11.814Z",
"dateUpdated": "2026-08-28T15:58:01.239Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72556 (GCVE-0-2026-72556)
Vulnerability from nvd – Published: 2026-08-11 11:11 – Updated: 2026-08-11 15:18
VLAI
EPSS
VEX
Title
ZoneMinder ZoneMinder - Remote Code Execution
Summary
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\User class, causing PHP __call() to return a truthy value that bypasses the permission check for all users. Any authenticated user can trigger filter-based OS command execution regardless of their assigned role.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 15:18 UTC
CWE
- CWE-78 - OS Command Injection
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | ZoneMinder |
Affected:
0 , ≤ 1.39.17
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72556",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T15:18:09.527054Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T15:18:18.657Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ZoneMinder",
"vendor": "ZoneMinder",
"versions": [
{
"lessThanOrEqual": "1.39.17",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bobur Abdugafforov"
}
],
"descriptions": [
{
"lang": "en",
"value": "A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\\User class, causing PHP __call() to return a truthy value that bypasses the permission check for all users. Any authenticated user can trigger filter-based OS command execution regardless of their assigned role."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:11:40.192Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Project Repository",
"url": "https://github.com/ZoneMinder/zoneminder"
}
],
"title": "ZoneMinder ZoneMinder - Remote Code Execution"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-72556",
"datePublished": "2026-08-11T11:11:40.192Z",
"dateReserved": "2026-08-10T10:32:49.081Z",
"dateUpdated": "2026-08-11T15:18:18.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-27470 (GCVE-0-2026-27470)
Vulnerability from nvd – Published: 2026-02-21 08:05 – Updated: 2026-02-24 18:29
VLAI
EPSS
VEX
Title
ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields
Summary
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function. Event field values (specifically Name and Cause) are stored safely via parameterized queries but are later retrieved and concatenated directly into SQL WHERE clauses without escaping. An authenticated user with Events edit and view permissions can exploit this to execute arbitrary SQL queries.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-24 18:29 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/security… | x_refsource_CONFIRM |
| https://github.com/ZoneMinder/zoneminder/releases… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/releases… | x_refsource_MISC |
| https://owasp.org/www-community/attacks/SQL_Injection | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
< 1.36.38
Affected: >= 1.37.61, < 1.38.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-27470",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-24T18:29:18.991539Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T18:29:37.068Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"status": "affected",
"version": "\u003c 1.36.38"
},
{
"status": "affected",
"version": "\u003e= 1.37.61, \u003c 1.38.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function. Event field values (specifically Name and Cause) are stored safely via parameterized queries but are later retrieved and concatenated directly into SQL WHERE clauses without escaping. An authenticated user with Events edit and view permissions can exploit this to execute arbitrary SQL queries."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-21T08:05:01.073Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-r6gm-478g-f2c4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-r6gm-478g-f2c4"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.36.38",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.36.38"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.1"
},
{
"name": "https://owasp.org/www-community/attacks/SQL_Injection",
"tags": [
"x_refsource_MISC"
],
"url": "https://owasp.org/www-community/attacks/SQL_Injection"
}
],
"source": {
"advisory": "GHSA-r6gm-478g-f2c4",
"discovery": "UNKNOWN"
},
"title": "ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-27470",
"datePublished": "2026-02-21T08:05:01.073Z",
"dateReserved": "2026-02-19T17:25:31.101Z",
"dateUpdated": "2026-02-24T18:29:37.068Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-65791 (GCVE-0-2025-65791)
Vulnerability from nvd – Published: 2026-02-18 00:00 – Updated: 2026-03-11 03:08 Disputed
VLAI
EPSS
VEX
Summary
ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. NOTE: this is disputed by the Supplier because there is no unsanitized user input to web/views/image.php.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-18 16:28 UTC
CWE
- n/a
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-65791",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-18T16:28:08.980767Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-18T16:28:39.723Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. NOTE: this is disputed by the Supplier because there is no unsanitized user input to web/views/image.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-11T03:08:51.892Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/rishavand1/CVE-2025-65791"
}
],
"tags": [
"disputed"
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-65791",
"datePublished": "2026-02-18T00:00:00.000Z",
"dateReserved": "2025-11-18T00:00:00.000Z",
"dateUpdated": "2026-03-11T03:08:51.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-51482 (GCVE-0-2024-51482)
Vulnerability from nvd – Published: 2024-10-31 18:07 – Updated: 2024-11-08 16:49
VLAI
EPSS
VEX
Title
Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64
Summary
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* <= 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is fixed in 1.37.65.
Severity
10 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-31 19:38 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/security… | x_refsource_CONFIRM |
| https://github.com/ZoneMinder/zoneminder/commit/9… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
>= 1.37.0, < 1.37.65
|
|
| zoneminder | zoneminder |
Affected:
1.37.0 , ≤ 1.37.64
(custom)
cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "zoneminder",
"vendor": "zoneminder",
"versions": [
{
"lessThanOrEqual": "1.37.64",
"status": "affected",
"version": "1.37.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-51482",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-31T19:38:43.424341Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-08T16:49:08.199Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.37.0, \u003c 1.37.65"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* \u003c= 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is fixed in 1.37.65."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T13:41:25.010Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-qm8h-3xvf-m7j3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-qm8h-3xvf-m7j3"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/9e7d31841ed9678a7dd06869037686fc9925e59f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/9e7d31841ed9678a7dd06869037686fc9925e59f"
}
],
"source": {
"advisory": "GHSA-qm8h-3xvf-m7j3",
"discovery": "UNKNOWN"
},
"title": "Boolean-based SQL Injection in ZoneMinder v1.37.* \u003c= 1.37.64"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-51482",
"datePublished": "2024-10-31T18:07:25.310Z",
"dateReserved": "2024-10-28T14:20:59.335Z",
"dateUpdated": "2024-11-08T16:49:08.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31493 (GCVE-0-2023-31493)
Vulnerability from nvd – Published: 2024-10-15 00:00 – Updated: 2026-07-05 00:45
VLAI
EPSS
VEX
Summary
RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted payload and escalate privileges allowing execution of any commands on the remote system.
Severity
6.6 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-16 18:53 UTC
CWE
- n/a
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zoneminder | zoneminder |
Affected:
0 , ≤ 1.36.33
(custom)
cpe:2.3:a:zoneminder:zoneminder:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:zoneminder:zoneminder:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "zoneminder",
"vendor": "zoneminder",
"versions": [
{
"lessThanOrEqual": "1.36.33",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-31493",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-16T18:53:24.875640Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-16T18:56:57.965Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted payload and escalate privileges allowing execution of any commands on the remote system."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-05T00:45:44.676Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://medium.com/@dk50u1/rce-remote-code-execution-in-zoneminder-up-to-1-36-33-0686f5bcd370"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-31493",
"datePublished": "2024-10-15T00:00:00.000Z",
"dateReserved": "2023-04-29T00:00:00.000Z",
"dateUpdated": "2026-07-05T00:45:44.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-43360 (GCVE-0-2024-43360)
Vulnerability from nvd – Published: 2024-08-12 20:55 – Updated: 2024-08-15 19:00Title
ZoneMinder Time-based SQL Injection
Summary
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-15 18:53 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/security… | x_refsource_CONFIRM |
| https://github.com/ZoneMinder/zoneminder/commit/6… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/a… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/b… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/d… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
< 1.36.34
Affected: >= 1.37.0, < 1.37.61 |
|
| zoneminder | zoneminder |
Affected:
\u003c.1.36.34
Affected: 1.37.0 , ≤ 1.37.61 (custom) cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "zoneminder",
"vendor": "zoneminder",
"versions": [
{
"status": "affected",
"version": "\\u003c.1.36.34"
},
{
"lessThanOrEqual": "1.37.61",
"status": "affected",
"version": "1.37.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-43360",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-15T18:53:18.459320Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T19:00:59.189Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"status": "affected",
"version": "\u003c 1.36.34"
},
{
"status": "affected",
"version": "\u003e= 1.37.0, \u003c 1.37.61"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-12T20:55:14.760Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5"
}
],
"source": {
"advisory": "GHSA-9cmr-7437-v9fj",
"discovery": "UNKNOWN"
},
"title": "ZoneMinder Time-based SQL Injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-43360",
"datePublished": "2024-08-12T20:55:14.760Z",
"dateReserved": "2024-08-09T14:23:55.511Z",
"dateUpdated": "2024-08-15T19:00:59.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-43359 (GCVE-0-2024-43359)
Vulnerability from nvd – Published: 2024-08-12 20:49 – Updated: 2024-08-13 17:05
VLAI
EPSS
VEX
Title
XSS vulnerabilities in montagereview
Summary
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the montagereview via the displayinterval, speed, and scale parameters. This vulnerability is fixed in 1.36.34 and 1.37.61.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-13 17:03 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/security… | x_refsource_CONFIRM |
| https://github.com/ZoneMinder/zoneminder/commit/6… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/b… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
< 1.36.34
Affected: >= 1.37.0, < 1.37.61 |
|
| zoneminder | zoneminder |
Affected:
0 , < 1.36.34
(custom)
Affected: 1.37.0 , < 1.37.61 (custom) cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "zoneminder",
"vendor": "zoneminder",
"versions": [
{
"lessThan": "1.36.34",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "1.37.61",
"status": "affected",
"version": "1.37.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-43359",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-13T17:03:34.296728Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-13T17:05:24.009Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"status": "affected",
"version": "\u003c 1.36.34"
},
{
"status": "affected",
"version": "\u003e= 1.37.0, \u003c 1.37.61"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the montagereview via the displayinterval, speed, and scale parameters. This vulnerability is fixed in 1.36.34 and 1.37.61."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 0,
"baseSeverity": "NONE",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-12T20:49:28.130Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-pjjm-3qxp-6hj8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-pjjm-3qxp-6hj8"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/6cc64dddff6144a98680f65ecf8dc249028431af",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/6cc64dddff6144a98680f65ecf8dc249028431af"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/b51c5df0cb869ca48fccfc6e6fd7c19bf717ecd2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/b51c5df0cb869ca48fccfc6e6fd7c19bf717ecd2"
}
],
"source": {
"advisory": "GHSA-pjjm-3qxp-6hj8",
"discovery": "UNKNOWN"
},
"title": "XSS vulnerabilities in montagereview"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-43359",
"datePublished": "2024-08-12T20:49:28.130Z",
"dateReserved": "2024-08-09T14:23:55.511Z",
"dateUpdated": "2024-08-13T17:05:24.009Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-30971 (GCVE-0-2026-30971)
Vulnerability from cvelistv5 – Published: 2026-10-16 19:40 – Updated: 2026-10-16 19:57
VLAI
EPSS
VEX
Title
ZoneMinder: Authenticated RCE via command injection in monitor Device Path
Summary
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:56 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/security… | x_refsource_CONFIRM |
| https://github.com/ZoneMinder/zoneminder/commit/4… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
< 1.36.40
Affected: >= 1.38.0, < 1.38.2 Affected: >= 1.39.0, < 1.39.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-30971",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:56:46.321699Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:57:11.752Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-g66m-77fq-79v9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"status": "affected",
"version": "\u003c 1.36.40"
},
{
"status": "affected",
"version": "\u003e= 1.38.0, \u003c 1.38.2"
},
{
"status": "affected",
"version": "\u003e= 1.39.0, \u003c 1.39.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:40:51.681Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-g66m-77fq-79v9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-g66m-77fq-79v9"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/419846c8750c3f45b9b8a1df8cd49c189a14dc03",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/419846c8750c3f45b9b8a1df8cd49c189a14dc03"
}
],
"source": {
"advisory": "GHSA-g66m-77fq-79v9",
"discovery": "UNKNOWN"
},
"title": "ZoneMinder: Authenticated RCE via command injection in monitor Device Path"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-30971",
"datePublished": "2026-10-16T19:40:51.681Z",
"dateReserved": "2026-03-07T17:53:48.815Z",
"dateUpdated": "2026-10-16T19:57:11.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102608 (GCVE-0-2026-102608)
Vulnerability from cvelistv5 – Published: 2026-10-16 19:35 – Updated: 2026-10-19 16:41
VLAI
EPSS
VEX
Title
ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)
Summary
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.
Severity
9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:41 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/security… | x_refsource_CONFIRM |
| https://github.com/ZoneMinder/zoneminder/commit/2… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/b… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/b… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/releases… | x_refsource_MISC |
| https://www.scriptkittens.com/blog/two-sinks-one-shell | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
>= 1.37.48, < 1.38.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102608",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:41:30.335802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:41:08.186Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.37.48, \u003c 1.38.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor\u0027s events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:35:36.862Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/2de2ae44a1d751bad4b020c5573b2d58c59c1525",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/2de2ae44a1d751bad4b020c5573b2d58c59c1525"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/b3a7c05f079c87badf4b0ce052da0acfd4047a4b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/b3a7c05f079c87badf4b0ce052da0acfd4047a4b"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/b5605e01c14354fc8e2dcae8cefd90c3674880d9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/b5605e01c14354fc8e2dcae8cefd90c3674880d9"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.3"
},
{
"name": "https://www.scriptkittens.com/blog/two-sinks-one-shell",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.scriptkittens.com/blog/two-sinks-one-shell"
}
],
"source": {
"advisory": "GHSA-88m4-hrgp-m9v3",
"discovery": "UNKNOWN"
},
"title": "ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102608",
"datePublished": "2026-10-16T19:35:36.862Z",
"dateReserved": "2026-09-29T14:18:02.921Z",
"dateUpdated": "2026-10-19T16:41:08.186Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102607 (GCVE-0-2026-102607)
Vulnerability from cvelistv5 – Published: 2026-10-16 19:29 – Updated: 2026-10-19 14:26
VLAI
EPSS
VEX
Title
ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
Summary
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 14:25 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/security… | x_refsource_CONFIRM |
| https://github.com/ZoneMinder/zoneminder/commit/5… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/6… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
< 1.38.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102607",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T14:25:03.645262Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T14:26:23.072Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-7j62-cjxp-3cj5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"status": "affected",
"version": "\u003c 1.38.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:29:58.131Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-7j62-cjxp-3cj5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-7j62-cjxp-3cj5"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/548ed87d47a49c17b4c842f6fee8a08660deb427",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/548ed87d47a49c17b4c842f6fee8a08660deb427"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/605f962b7b6ba7f5780b3e6715b5418b8b2addca",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/605f962b7b6ba7f5780b3e6715b5418b8b2addca"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.3"
}
],
"source": {
"advisory": "GHSA-7j62-cjxp-3cj5",
"discovery": "UNKNOWN"
},
"title": "ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102607",
"datePublished": "2026-10-16T19:29:58.131Z",
"dateReserved": "2026-09-29T14:18:02.921Z",
"dateUpdated": "2026-10-19T14:26:23.072Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104198 (GCVE-0-2026-104198)
Vulnerability from cvelistv5 – Published: 2026-10-15 19:48 – Updated: 2026-10-15 20:34
VLAI
EPSS
VEX
Title
ZoneMinder failed token handling bypasses web authentication
Summary
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken() returns false when a token is malformed or has an invalid signature, but the caller assigns that value to the global $user variable; because web/index.php tests isset($user), boolean false is treated as a present user and the normal login redirect is skipped. This can dispatch views that rely on the outer authentication gate, including the zones view, which accepts an attacker-selected monitor ID and discloses monitor and zone metadata without an independent permission check. Permission helpers receive the false user value and deny privileged operations, so unauthorized state changes have not been established. This vulnerability is fixed in version 1.36.63, where conversion to ZM\User objects causes invalid token state to fail before view dispatch. Later defense-in-depth changes explicitly leave $user unset after failed token validation and reject non-ZM\User values at the web authentication gate.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 20:34 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/security… | x_refsource_CONFIRM |
| https://github.com/ZoneMinder/zoneminder/commit/1… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/6… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/7… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/9… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/9… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/commit/d… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
>= 1.34.0, < 1.36.63
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104198",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T20:34:15.363799Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T20:34:55.708Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.34.0, \u003c 1.36.63"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken() returns false when a token is malformed or has an invalid signature, but the caller assigns that value to the global $user variable; because web/index.php tests isset($user), boolean false is treated as a present user and the normal login redirect is skipped. This can dispatch views that rely on the outer authentication gate, including the zones view, which accepts an attacker-selected monitor ID and discloses monitor and zone metadata without an independent permission check. Permission helpers receive the false user value and deny privileged operations, so unauthorized state changes have not been established. This vulnerability is fixed in version 1.36.63, where conversion to ZM\\User objects causes invalid token state to fail before view dispatch. Later defense-in-depth changes explicitly leave $user unset after failed token validation and reject non-ZM\\User values at the web authentication gate."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-697",
"description": "CWE-697: Incorrect Comparison",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:48:52.831Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-23fj-frfw-hmcr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-23fj-frfw-hmcr"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/144a04ca4fff5fd02745ce8afc239ba5e05cf8ac",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/144a04ca4fff5fd02745ce8afc239ba5e05cf8ac"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/6b94903e634fdb46cb71a48eadccf1aa14f0c2bb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/6b94903e634fdb46cb71a48eadccf1aa14f0c2bb"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/71bb186b230dbe2aba5e2f804c36810aae892088",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/71bb186b230dbe2aba5e2f804c36810aae892088"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/95460a945ab7e5c63dc0551bdd6230a3026ceb9e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/95460a945ab7e5c63dc0551bdd6230a3026ceb9e"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/969baa38912018b502617d09e836d0bfa57d4af6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/969baa38912018b502617d09e836d0bfa57d4af6"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/d71fbb805e4695a9599498a1a2ee3b286ef41c96",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/d71fbb805e4695a9599498a1a2ee3b286ef41c96"
}
],
"source": {
"advisory": "GHSA-23fj-frfw-hmcr",
"discovery": "UNKNOWN"
},
"title": "ZoneMinder failed token handling bypasses web authentication"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-104198",
"datePublished": "2026-10-15T19:48:52.831Z",
"dateReserved": "2026-10-01T18:54:15.119Z",
"dateUpdated": "2026-10-15T20:34:55.708Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102297 (GCVE-0-2026-102297)
Vulnerability from cvelistv5 – Published: 2026-09-28 22:00 – Updated: 2026-10-06 13:36
VLAI
EPSS
VEX
Title
ZoneMinder before 1.38.4 Incorrect Authorization in frames API index
Summary
ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 18:00 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/commit/a… | patch |
| https://github.com/ZoneMinder/zoneminder | product |
| https://github.com/ZoneMinder/zoneminder/security… | vendor-advisory |
| https://github.com/ZoneMinder/zoneminder/commit/e… | patch |
| https://github.com/ZoneMinder/zoneminder/releases… | release-notes |
| https://github.com/ZoneMinder/zoneminder/blob/1.3… | technical-description |
| https://www.vulncheck.com/advisories/zoneminder-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
0 , < 1.38.4
(semver)
Unaffected: 1.38.4 (semver) cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* |
Date Public
2026-07-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102297",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T18:00:09.719698Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T18:00:24.304Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mg2g-jmfc-3w8g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/ZoneMinder/zoneminder",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ZoneMinder/zoneminder",
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"lessThan": "1.38.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.38.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.38.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "arpitjain099"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-07-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:36:53.906Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/aafe580b231bbeead12a110a957d85a26f7a23be"
},
{
"tags": [
"product"
],
"url": "https://github.com/ZoneMinder/zoneminder"
},
{
"name": "GitHub Security Advisory (GHSA-mg2g-jmfc-3w8g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mg2g-jmfc-3w8g"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/efe6c60d8798c60ab41b120dc034488388c47dda"
},
{
"name": "zoneminder 1.38.4 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.4"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ZoneMinder/zoneminder/blob/1.38.3/web/api/app/Controller/FramesController.php#L51"
},
{
"name": "VulnCheck Advisory: ZoneMinder before 1.38.4 Incorrect Authorization in frames API index",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zoneminder-before-1.38.4-incorrect-authorization-in-frames-api-index"
}
],
"title": "ZoneMinder before 1.38.4 Incorrect Authorization in frames API index",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-102297",
"datePublished": "2026-09-28T22:00:19.790Z",
"dateReserved": "2026-09-28T21:24:45.106Z",
"dateUpdated": "2026-10-06T13:36:53.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102296 (GCVE-0-2026-102296)
Vulnerability from cvelistv5 – Published: 2026-09-28 22:00 – Updated: 2026-10-06 13:36
VLAI
EPSS
VEX
Title
ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response
Summary
ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Attackers can send crafted HTTP responses with oversized status messages, Connection headers, Content-Type values, or multipart boundaries to corrupt parser state and crash the capture process or corrupt memory.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 19:44 UTC
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/commit/2… | patch |
| https://github.com/ZoneMinder/zoneminder | product |
| https://github.com/ZoneMinder/zoneminder/security… | vendor-advisory |
| https://github.com/ZoneMinder/zoneminder/commit/8… | patch |
| https://github.com/ZoneMinder/zoneminder/releases… | release-notes |
| https://github.com/ZoneMinder/zoneminder/blob/1.3… | technical-description |
| https://www.vulncheck.com/advisories/zoneminder-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
0 , < 1.38.4
(semver)
Unaffected: 1.38.4 (semver) cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* |
Date Public
2026-07-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102296",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T19:44:10.856899Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T19:44:40.922Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-93j4-rcp9-9jx6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/ZoneMinder/zoneminder",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ZoneMinder/zoneminder",
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"lessThan": "1.38.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.38.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.38.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "TristanInSec"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-07-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Attackers can send crafted HTTP responses with oversized status messages, Connection headers, Content-Type values, or multipart boundaries to corrupt parser state and crash the capture process or corrupt memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:36:53.153Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/2596e5fb64c0348e615577b0ab08dc38b6dc6ed8"
},
{
"tags": [
"product"
],
"url": "https://github.com/ZoneMinder/zoneminder"
},
{
"name": "GitHub Security Advisory (GHSA-93j4-rcp9-9jx6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-93j4-rcp9-9jx6"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/813bf6f1a3ffc92c163352f2480477ba571fca5b"
},
{
"name": "zoneminder 1.38.4 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.4"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ZoneMinder/zoneminder/blob/1.38.3/src/zm_remote_camera_http.cpp#L736"
},
{
"name": "VulnCheck Advisory: ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zoneminder-before-1.38.4-buffer-overflow-via-http-camera-response"
}
],
"title": "ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-102296",
"datePublished": "2026-09-28T22:00:19.143Z",
"dateReserved": "2026-09-28T21:24:39.616Z",
"dateUpdated": "2026-10-06T13:36:53.153Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-58386 (GCVE-0-2024-58386)
Vulnerability from cvelistv5 – Published: 2026-09-28 22:00 – Updated: 2026-10-06 13:36
VLAI
EPSS
VEX
Title
ZoneMinder 1.37.x Path Traversal via files view
Summary
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to output_file, enabling attackers with Events view permission to access sensitive files like configuration files containing database credentials.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 19:42 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/commit/3… | patch |
| https://github.com/ZoneMinder/zoneminder | product |
| https://github.com/ZoneMinder/zoneminder/security… | vendor-advisory |
| https://github.com/ZoneMinder/zoneminder/commit/0… | patch |
| https://github.com/ZoneMinder/zoneminder/issues/4472 | issue-tracking |
| https://github.com/ZoneMinder/zoneminder/releases… | release-notes |
| https://github.com/ZoneMinder/zoneminder/blob/1.3… | technical-description |
| https://www.vulncheck.com/advisories/zoneminder-1… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
1.37.0 , < 1.38.0
(semver)
cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* |
Date Public
2024-09-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-58386",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T19:42:42.975996Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T19:42:55.370Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/ZoneMinder/zoneminder",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ZoneMinder/zoneminder",
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"lessThan": "1.38.0",
"status": "affected",
"version": "1.37.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.38.0",
"versionStartIncluding": "1.37.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2024-09-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to output_file, enabling attackers with Events view permission to access sensitive files like configuration files containing database credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:36:44.922Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/3b379e99c0c1e539334ad4186c15ad0dc6c238b9"
},
{
"tags": [
"product"
],
"url": "https://github.com/ZoneMinder/zoneminder"
},
{
"name": "GitHub Security Advisory (GHSA-8fw2-wh82-vv4h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-8fw2-wh82-vv4h"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/071d968bc8ecd5c4f56a87cbe0c3063bc35dbc5d"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/ZoneMinder/zoneminder/issues/4472"
},
{
"name": "zoneminder 1.38.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ZoneMinder/zoneminder/blob/1.37.64/web/skins/classic/views/files.php#L26-L39"
},
{
"name": "VulnCheck Advisory: ZoneMinder 1.37.x Path Traversal via files view",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zoneminder-1.37-x-path-traversal-via-files-view"
}
],
"title": "ZoneMinder 1.37.x Path Traversal via files view",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-58386",
"datePublished": "2026-09-28T22:00:16.575Z",
"dateReserved": "2026-09-28T21:24:45.481Z",
"dateUpdated": "2026-10-06T13:36:44.922Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54258 (GCVE-0-2026-54258)
Vulnerability from cvelistv5 – Published: 2026-09-11 21:31 – Updated: 2026-09-15 16:50
VLAI
EPSS
VEX
Title
Cross-monitor event media authorization bypass in direct event media endpoints
Summary
ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse `Events=View` and/or `Snapshots=View` permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI correctly hides the restricted monitor and its events, but direct event media views accept an arbitrary `eid` and stream media from the event path without enforcing the event/monitor-level ACL. This exposes private surveillance footage across monitor boundaries. Versions 1.36.39, 1.38.4, and 1.39.11 fix the issue.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 16:49 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/security… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
< 1.36.39
Affected: >= 1.37.0, < 1.38.4 Affected: >= 1.39.0, < 1.39.11 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54258",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T16:49:55.325622Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T16:50:32.195Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-vj5r-pc2v-gfwv"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"status": "affected",
"version": "\u003c 1.36.39"
},
{
"status": "affected",
"version": "\u003e= 1.37.0, \u003c 1.38.4"
},
{
"status": "affected",
"version": "\u003e= 1.39.0, \u003c 1.39.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse `Events=View` and/or `Snapshots=View` permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI correctly hides the restricted monitor and its events, but direct event media views accept an arbitrary `eid` and stream media from the event path without enforcing the event/monitor-level ACL. This exposes private surveillance footage across monitor boundaries. Versions 1.36.39, 1.38.4, and 1.39.11 fix the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T21:31:30.218Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-vj5r-pc2v-gfwv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-vj5r-pc2v-gfwv"
}
],
"source": {
"advisory": "GHSA-vj5r-pc2v-gfwv",
"discovery": "UNKNOWN"
},
"title": "Cross-monitor event media authorization bypass in direct event media endpoints"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54258",
"datePublished": "2026-09-11T21:31:30.218Z",
"dateReserved": "2026-06-12T17:13:32.278Z",
"dateUpdated": "2026-09-15T16:50:32.195Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76060 (GCVE-0-2026-76060)
Vulnerability from cvelistv5 – Published: 2026-08-27 20:29 – Updated: 2026-08-28 15:58
VLAI
EPSS
VEX
Title
OS Command Injection in PayRange API
Summary
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 15:45 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zoneminder | Zoneminder |
Affected:
1.37.48 , < 1.38.3
(custom)
Unaffected: 1.38.3 |
Date Public
2026-08-25 21:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76060",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T15:45:46.658133Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T15:58:01.239Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Zoneminder",
"vendor": "Zoneminder",
"versions": [
{
"lessThan": "1.38.3",
"status": "affected",
"version": "1.37.48",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.38.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "CISA discovered a public proof of concept (PoC) as authored by Scriptkittens and reported it to Zoneminder."
}
],
"datePublic": "2026-08-25T21:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authenticated OS command injection vulnerability exists in ZoneMinder\u0027s event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP\u0027s exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server."
}
],
"value": "An authenticated OS command injection vulnerability exists in ZoneMinder\u0027s event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP\u0027s exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T20:29:05.262Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://zoneminder.com/downloads"
},
{
"url": "https://github.com/ZoneMinder/zoneminder"
},
{
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-02"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-02.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eZoneminder recommends upgrading to version 1.38.3 or later by downloading the installer for your system at: \u003ca href=\"https://zoneminder.com/downloads\"\u003ehttps://zoneminder.com/downloads\u003c/a\u003e.\u0026nbsp;\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eUsers may also get the source code from Zoneminder\u0027s Github: \u003ca href=\"https://github.com/ZoneMinder/zoneminder\"\u003ehttps://github.com/ZoneMinder/zoneminder\u003c/a\u003e.\u0026nbsp;\u003c/span\u003e\u0026nbsp;\u003c/div\u003e\u003cdiv\u003eFor more details refer to Zoneminder\u0027s security advisories at: \u003ca href=\"https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3\"\u003ehttps://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3\u003c/a\u003e.\u003c/div\u003e"
}
],
"value": "Zoneminder recommends upgrading to version 1.38.3 or later by downloading the installer for your system at: https://zoneminder.com/downloads .\u00a0\n\nUsers may also get the source code from Zoneminder\u0027s Github: https://github.com/ZoneMinder/zoneminder .\u00a0\u00a0\n\nFor more details refer to Zoneminder\u0027s security advisories at: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3 ."
}
],
"source": {
"advisory": "ICSA-26-237-02",
"discovery": "EXTERNAL"
},
"title": "OS Command Injection in PayRange API",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-76060",
"datePublished": "2026-08-27T20:29:05.262Z",
"dateReserved": "2026-08-18T20:49:11.814Z",
"dateUpdated": "2026-08-28T15:58:01.239Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72556 (GCVE-0-2026-72556)
Vulnerability from cvelistv5 – Published: 2026-08-11 11:11 – Updated: 2026-08-11 15:18
VLAI
EPSS
VEX
Title
ZoneMinder ZoneMinder - Remote Code Execution
Summary
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\User class, causing PHP __call() to return a truthy value that bypasses the permission check for all users. Any authenticated user can trigger filter-based OS command execution regardless of their assigned role.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 15:18 UTC
CWE
- CWE-78 - OS Command Injection
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | ZoneMinder |
Affected:
0 , ≤ 1.39.17
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72556",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T15:18:09.527054Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T15:18:18.657Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ZoneMinder",
"vendor": "ZoneMinder",
"versions": [
{
"lessThanOrEqual": "1.39.17",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bobur Abdugafforov"
}
],
"descriptions": [
{
"lang": "en",
"value": "A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\\User class, causing PHP __call() to return a truthy value that bypasses the permission check for all users. Any authenticated user can trigger filter-based OS command execution regardless of their assigned role."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:11:40.192Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Project Repository",
"url": "https://github.com/ZoneMinder/zoneminder"
}
],
"title": "ZoneMinder ZoneMinder - Remote Code Execution"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-72556",
"datePublished": "2026-08-11T11:11:40.192Z",
"dateReserved": "2026-08-10T10:32:49.081Z",
"dateUpdated": "2026-08-11T15:18:18.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-27470 (GCVE-0-2026-27470)
Vulnerability from cvelistv5 – Published: 2026-02-21 08:05 – Updated: 2026-02-24 18:29
VLAI
EPSS
VEX
Title
ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields
Summary
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function. Event field values (specifically Name and Cause) are stored safely via parameterized queries but are later retrieved and concatenated directly into SQL WHERE clauses without escaping. An authenticated user with Events edit and view permissions can exploit this to execute arbitrary SQL queries.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-24 18:29 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/security… | x_refsource_CONFIRM |
| https://github.com/ZoneMinder/zoneminder/releases… | x_refsource_MISC |
| https://github.com/ZoneMinder/zoneminder/releases… | x_refsource_MISC |
| https://owasp.org/www-community/attacks/SQL_Injection | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
< 1.36.38
Affected: >= 1.37.61, < 1.38.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-27470",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-24T18:29:18.991539Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T18:29:37.068Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"status": "affected",
"version": "\u003c 1.36.38"
},
{
"status": "affected",
"version": "\u003e= 1.37.61, \u003c 1.38.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function. Event field values (specifically Name and Cause) are stored safely via parameterized queries but are later retrieved and concatenated directly into SQL WHERE clauses without escaping. An authenticated user with Events edit and view permissions can exploit this to execute arbitrary SQL queries."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-21T08:05:01.073Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-r6gm-478g-f2c4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-r6gm-478g-f2c4"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.36.38",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.36.38"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.1"
},
{
"name": "https://owasp.org/www-community/attacks/SQL_Injection",
"tags": [
"x_refsource_MISC"
],
"url": "https://owasp.org/www-community/attacks/SQL_Injection"
}
],
"source": {
"advisory": "GHSA-r6gm-478g-f2c4",
"discovery": "UNKNOWN"
},
"title": "ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-27470",
"datePublished": "2026-02-21T08:05:01.073Z",
"dateReserved": "2026-02-19T17:25:31.101Z",
"dateUpdated": "2026-02-24T18:29:37.068Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-65791 (GCVE-0-2025-65791)
Vulnerability from cvelistv5 – Published: 2026-02-18 00:00 – Updated: 2026-03-11 03:08 Disputed
VLAI
EPSS
VEX
Summary
ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. NOTE: this is disputed by the Supplier because there is no unsanitized user input to web/views/image.php.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-18 16:28 UTC
CWE
- n/a
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-65791",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-18T16:28:08.980767Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-18T16:28:39.723Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. NOTE: this is disputed by the Supplier because there is no unsanitized user input to web/views/image.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-11T03:08:51.892Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/rishavand1/CVE-2025-65791"
}
],
"tags": [
"disputed"
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-65791",
"datePublished": "2026-02-18T00:00:00.000Z",
"dateReserved": "2025-11-18T00:00:00.000Z",
"dateUpdated": "2026-03-11T03:08:51.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-51482 (GCVE-0-2024-51482)
Vulnerability from cvelistv5 – Published: 2024-10-31 18:07 – Updated: 2024-11-08 16:49
VLAI
EPSS
VEX
Title
Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64
Summary
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* <= 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is fixed in 1.37.65.
Severity
10 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-31 19:38 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ZoneMinder/zoneminder/security… | x_refsource_CONFIRM |
| https://github.com/ZoneMinder/zoneminder/commit/9… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ZoneMinder | zoneminder |
Affected:
>= 1.37.0, < 1.37.65
|
|
| zoneminder | zoneminder |
Affected:
1.37.0 , ≤ 1.37.64
(custom)
cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "zoneminder",
"vendor": "zoneminder",
"versions": [
{
"lessThanOrEqual": "1.37.64",
"status": "affected",
"version": "1.37.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-51482",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-31T19:38:43.424341Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-08T16:49:08.199Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zoneminder",
"vendor": "ZoneMinder",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.37.0, \u003c 1.37.65"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* \u003c= 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is fixed in 1.37.65."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T13:41:25.010Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-qm8h-3xvf-m7j3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-qm8h-3xvf-m7j3"
},
{
"name": "https://github.com/ZoneMinder/zoneminder/commit/9e7d31841ed9678a7dd06869037686fc9925e59f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZoneMinder/zoneminder/commit/9e7d31841ed9678a7dd06869037686fc9925e59f"
}
],
"source": {
"advisory": "GHSA-qm8h-3xvf-m7j3",
"discovery": "UNKNOWN"
},
"title": "Boolean-based SQL Injection in ZoneMinder v1.37.* \u003c= 1.37.64"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-51482",
"datePublished": "2024-10-31T18:07:25.310Z",
"dateReserved": "2024-10-28T14:20:59.335Z",
"dateUpdated": "2024-11-08T16:49:08.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31493 (GCVE-0-2023-31493)
Vulnerability from cvelistv5 – Published: 2024-10-15 00:00 – Updated: 2026-07-05 00:45
VLAI
EPSS
VEX
Summary
RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted payload and escalate privileges allowing execution of any commands on the remote system.
Severity
6.6 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-16 18:53 UTC
CWE
- n/a
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zoneminder | zoneminder |
Affected:
0 , ≤ 1.36.33
(custom)
cpe:2.3:a:zoneminder:zoneminder:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:zoneminder:zoneminder:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "zoneminder",
"vendor": "zoneminder",
"versions": [
{
"lessThanOrEqual": "1.36.33",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-31493",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-16T18:53:24.875640Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-16T18:56:57.965Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted payload and escalate privileges allowing execution of any commands on the remote system."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-05T00:45:44.676Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://medium.com/@dk50u1/rce-remote-code-execution-in-zoneminder-up-to-1-36-33-0686f5bcd370"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-31493",
"datePublished": "2024-10-15T00:00:00.000Z",
"dateReserved": "2023-04-29T00:00:00.000Z",
"dateUpdated": "2026-07-05T00:45:44.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}