Skip to content
Noroxi

Zabbix records

135 published records for vendor zabbix.

Researcher profile

Entered KEV
2 · 1.5%
Weaponized
7 · 5.2%
Pre-auth RCE
19
With a fix record
97%
Median publish → KEV
40 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

135 records
  • CVE-2022-23131
    98Now

    Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML

    CriticalCVSS 9.8KEVWeaponizedEPSS 95%

    zabbix · zabbixJan 13, 2022

  • CVE-2022-23134
    80Now

    Possible view of the setup pages by unauthenticated users if config file already exists

    MediumCVSS 5.3KEVWeaponizedEPSS 95%

    zabbix · zabbixJan 13, 2022

  • CVE-2016-10134
    64This week

    SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the t

    CriticalCVSS 9.8WeaponizedEPSS 82%

    zabbix · zabbixFeb 16, 2017

  • CVE-2013-5743
    63This week

    Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7.

    CriticalCVSS 9.8WeaponizedEPSS 79%

    zabbix · zabbixDec 11, 2019

  • CVE-2024-42327
    63This week

    SQL injection in user.get API

    CriticalCVSS 9.9Proof of conceptEPSS 79%

    zabbix · zabbixNov 27, 2024

  • CVE-2024-22120
    58Plan

    Time Based SQL Injection in Zabbix Server Audit Log

    HighCVSS 8.8Proof of conceptEPSS 76%

    zabbix · zabbixMay 17, 2024

  • CVE-2013-3628
    55Plan

    Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability

    HighCVSS 8.8WeaponizedEPSS 67%

    zabbix · zabbixFeb 7, 2020

  • CVE-2019-17382
    52Plan

    An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4.

    CriticalCVSS 9.1Proof of conceptEPSS 53%

    zabbix · zabbixOct 9, 2019

  • CVE-2024-36465
    46Plan

    SQL injection in Zabbix API

    HighCVSS 8.6No exploitEPSS 39%

    zabbix · zabbixApr 2, 2025

  • CVE-2009-4502
    43Plan

    The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the

    CriticalCVSS 9.3WeaponizedEPSS 21%

    zabbix · zabbixDec 31, 2009

  • CVE-2020-11800
    42Plan

    Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code.

    CriticalCVSS 9.8Proof of conceptEPSS 9%

    zabbix · zabbixOct 7, 2020

  • CVE-2014-3005
    41Plan

    XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.

    CriticalCVSS 9.8No exploitEPSS 6%

    zabbix · zabbixFeb 1, 2018

  • CVE-2007-0640
    41Plan

    Buffer overflow in ZABBIX before 1.1.5 has unknown impact and attack vectors related to "SNMP IP addresses."

    CriticalCVSS 10.0No exploitEPSS 2%

    zabbix · zabbixJan 31, 2007

  • CVE-2023-29452
    40Plan

    Remove possibility to add html into Geomap attribution field

    MediumCVSS 5.4No exploitEPSS 64%

    zabbix · zabbixJul 13, 2023

  • CVE-2009-4498
    40Plan

    The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request.

    MediumCVSS 6.8WeaponizedEPSS 31%

    zabbix · zabbixDec 31, 2009

  • CVE-2017-2824
    40Plan

    An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X.

    HighCVSS 8.1Proof of conceptEPSS 26%

    zabbix · zabbixMay 24, 2017

  • CVE-2016-4338
    40Plan

    The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.

    HighCVSS 8.1Proof of conceptEPSS 25%

    zabbix · zabbixJan 23, 2017

  • CVE-2013-3738
    40Plan

    A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequate sanitization of request strings in CGI scripts, which could let a re

    CriticalCVSS 9.8No exploitEPSS 3%

    zabbix · zabbixFeb 17, 2020

  • CVE-2022-22704
    39Monitor

    The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expe

    CriticalCVSS 9.8No exploitEPSS 1%

    zabbix · zabbix-agent2Jan 6, 2022

  • CVE-2022-43515
    39Monitor

    X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance mode

    CriticalCVSS 9.8No exploitEPSS 1%

    zabbix · frontendDec 5, 2022

  • CVE-2022-43516
    39Monitor

    Zabbix Agent installer adds “allow all TCP any any” firewall rule

    CriticalCVSS 9.8No exploitEPSS 0%

    microsoft · windows firewallDec 5, 2022

  • CVE-2023-29453
    39Monitor

    Agent 2 package are built with Go version affected by CVE-2023-24538

    CriticalCVSS 9.8No exploitEPSS 0%

    zabbix · zabbix-agent2Oct 12, 2023

  • CVE-2023-32728
    39Monitor

    Code injection in zabbix_agent2 smart.disk.get caused by smartctl plugin

    CriticalCVSS 9.8No exploitEPSS 0%

    zabbix · zabbix-agent2Dec 18, 2023

  • CVE-2022-46768
    37Monitor

    File name information disclosure vulnerability in Zabbix Web Service Report Generation

    MediumCVSS 5.9No exploitEPSS 47%

    zabbix · web service report generationDec 15, 2022

  • CVE-2021-27927
    36Monitor

    In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControll

    HighCVSS 8.8No exploitEPSS 2%

    zabbix · zabbixMar 3, 2021