ZZoneMinder

Products

Exploited and recent CVEs

• CVE-2026-30971 High 8.8 ZoneMinder: Authenticated RCE via command injection in monitor Device Path 1.1%
• CVE-2026-102608 Critical 9.0 ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php) 0.3%
• CVE-2026-102607 High 8.8 ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature 0.4%
• CVE-2026-104198 Medium 5.3 ZoneMinder failed token handling bypasses web authentication 0.4%
• CVE-2026-102297 Medium 4.3 ZoneMinder before 1.38.4 Incorrect Authorization in frames API index 0.3%
• CVE-2026-102296 Medium 6.5 ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response 0.4%
• CVE-2024-58386 Medium 6.5 ZoneMinder 1.37.x Path Traversal via files view 0.4%
• CVE-2026-54258 Medium 6.5 Cross-monitor event media authorization bypass in direct event media endpoints 0.3%
• CVE-2026-76060 High 8.8 OS Command Injection in PayRange API 2.4%
• CVE-2026-72556 High 8.8 ZoneMinder ZoneMinder - Remote Code Execution 1.0%
• CVE-2026-27470 High 8.8 ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields 0.5%
• CVE-2024-51482 Critical 10.0 Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64 36.6%
• CVE-2024-43360 Critical 9.8 ZoneMinder Time-based SQL Injection 6.2%
• CVE-2024-43359 None 0.0 XSS vulnerabilities in montagereview 0.4%
• CVE-2024-43358 Medium 6.1 XSS vulnerability in filter view 0.4%
• CVE-2023-41884 High 7.1 ZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.php 0.5%
• CVE-2023-26039 High 7.1 ZoneMinder vulnerable to OS Command injection in daemonControl() API 1.3%
• CVE-2023-26038 Medium 5.4 ZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php` 0.5%
• CVE-2023-26037 High 8.9 ZoneMinder contains SQL Injection via report_event_audit 0.6%
• CVE-2023-26036 High 8.1 ZoneMinder contains Local File Inclusion vulnerability 0.9%
• CVE-2023-26035 High 7.2 ZoneMinder vulnerable to Missing Authorization 80.5%
• CVE-2023-26034 Critical 9.6 ZoneMinder SQL Injection 1.6%
• CVE-2023-26032 High 8.9 ZoneMinder contains SQL injection via malicious Jason Web Token 0.6%
• CVE-2023-25825 High 7.7 ZoneMinder contains Cross-site Scripting via log viewing 0.7%
• CVE-2022-39291 Medium 5.4 Denial of service through logs in zoneminder 7.1%
• CVE-2022-39289 Critical 9.1 Database log access in ZoneMinder 1.0%
• CVE-2022-39290 High 8.0 CSRF key bypass using HTTP methods in zoneminder 7.9%
• CVE-2022-39285 High 7.6 Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder 5.1%