Skip to content
Noroxi

ZoneMinder records

86 published records for vendor zoneminder.

Researcher profile

Entered KEV
0 · 0%
Weaponized
3 · 3.5%
Pre-auth RCE
15
With a fix record
87.2%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 22
  6. 23
  7. 24
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

86 records
  • CVE-2023-26035
    63This week

    ZoneMinder vulnerable to Missing Authorization

    CriticalCVSS 9.8WeaponizedEPSS 80%

    zoneminder · zoneminderFeb 24, 2023

  • CVE-2022-29806
    59Plan

    ZoneMinder before 1.36.13 allows remote code execution via an invalid language.

    CriticalCVSS 9.8WeaponizedEPSS 67%

    zoneminder · zoneminderApr 26, 2022

  • CVE-2024-51482
    50Plan

    Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64

    CriticalCVSS 9.9Proof of conceptEPSS 36%

    zoneminder · zoneminderOct 31, 2024

  • CVE-2013-0232
    44Plan

    includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shel

    HighCVSS 7.5WeaponizedEPSS 47%

    zoneminder · zoneminderMar 20, 2013

  • CVE-2018-1000832
    41Plan

    ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidenti

    CriticalCVSS 9.8No exploitEPSS 6%

    zoneminder · zoneminderDec 20, 2018

  • CVE-2024-43360
    41Plan

    ZoneMinder Time-based SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 6%

    zoneminder · zoneminderAug 12, 2024

  • CVE-2008-3882
    41Plan

    Unspecified "Command Injection" vulnerability in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary commands via (1)

    CriticalCVSS 10.0No exploitEPSS 3%

    zoneminder · zoneminderSep 2, 2008

  • CVE-2019-6991
    40Plan

    A classic Stack-based buffer overflow exists in the zmLoadUser() function in zm_user.cpp of the zmu binary in ZoneMinder through 1.32.3, all

    CriticalCVSS 9.8No exploitEPSS 3%

    zoneminder · zoneminderJan 28, 2019

  • CVE-2018-1000833
    40Plan

    ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidenti

    CriticalCVSS 9.8No exploitEPSS 3%

    zoneminder · zoneminderDec 20, 2018

  • CVE-2019-8427
    40Plan

    daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters.

    CriticalCVSS 9.8No exploitEPSS 2%

    zoneminder · zoneminderFeb 17, 2019

  • CVE-2016-10204
    40Plan

    SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    zoneminder · zoneminderMar 3, 2017

  • CVE-2019-8429
    40Plan

    ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter.

    CriticalCVSS 9.8No exploitEPSS 1%

    zoneminder · zoneminderFeb 17, 2019

  • CVE-2025-65791
    40Plan

    ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    zoneminder · zoneminderFeb 18, 2026

  • CVE-2019-8423
    39Monitor

    ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.

    CriticalCVSS 9.8No exploitEPSS 1%

    zoneminder · zoneminderFeb 17, 2019

  • CVE-2019-8428
    39Monitor

    ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroup[Monitor

    CriticalCVSS 9.8No exploitEPSS 1%

    zoneminder · zoneminderFeb 17, 2019

  • CVE-2019-8424
    39Monitor

    ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter.

    CriticalCVSS 9.8No exploitEPSS 1%

    zoneminder · zoneminderFeb 17, 2019

  • CVE-2023-26036
    39Monitor

    ZoneMinder contains Local File Inclusion vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    zoneminder · zoneminderFeb 24, 2023

  • CVE-2023-26037
    39Monitor

    ZoneMinder contains SQL Injection via report_event_audit

    CriticalCVSS 9.8No exploitEPSS 0%

    zoneminder · zoneminderFeb 24, 2023

  • CVE-2023-26034
    35Monitor

    ZoneMinder SQL Injection

    HighCVSS 8.8No exploitEPSS 1%

    zoneminder · zoneminderFeb 24, 2023

  • CVE-2023-26039
    35Monitor

    ZoneMinder vulnerable to OS Command injection in daemonControl() API

    HighCVSS 8.8Proof of conceptEPSS 1%

    zoneminder · zoneminderFeb 24, 2023

  • CVE-2017-5368
    35Monitor

    ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF (Cross Site Request Forgery) which allows a re

    HighCVSS 8.8No exploitEPSS 1%

    zoneminder · zoneminderFeb 6, 2017

  • CVE-2016-10206
    35Monitor

    Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users

    HighCVSS 8.8No exploitEPSS 0%

    zoneminder · zoneminderMar 3, 2017

  • CVE-2019-7346
    35Monitor

    A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback function is called displaying a "Try again

    HighCVSS 8.8No exploitEPSS 0%

    zoneminder · zoneminderFeb 4, 2019

  • CVE-2026-27470
    35Monitor

    ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields

    HighCVSS 8.8Proof of conceptEPSS 0%

    zoneminder · zoneminderFeb 21, 2026

  • CVE-2016-10140
    32Monitor

    Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30

    HighCVSS 7.5Proof of conceptEPSS 6%

    zoneminder · zoneminderJan 13, 2017