Zoneminder vulnerabilities
28 CVEs and advisories name Zoneminder as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-30971ZoneMinder: Authenticated RCE via command injection in monitor Device Path
- CVE-2026-102608ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)
- CVE-2026-102607ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
- CVE-2026-104198ZoneMinder failed token handling bypasses web authentication
- CVE-2026-102297ZoneMinder before 1.38.4 Incorrect Authorization in frames API index
- CVE-2026-102296ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response
- CVE-2024-58386ZoneMinder 1.37.x Path Traversal via files view
- CVE-2026-54258Cross-monitor event media authorization bypass in direct event media endpoints
- CVE-2026-76060OS Command Injection in PayRange API
- CVE-2026-72556ZoneMinder ZoneMinder - Remote Code Execution
- CVE-2026-27470ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields
- CVE-2024-51482Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64
- CVE-2024-43360ZoneMinder Time-based SQL Injection
- CVE-2024-43359XSS vulnerabilities in montagereview
- CVE-2024-43358XSS vulnerability in filter view
- CVE-2023-41884ZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.php
- CVE-2023-26039ZoneMinder vulnerable to OS Command injection in daemonControl() API
- CVE-2023-26038ZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php`
- CVE-2023-26037ZoneMinder contains SQL Injection via report_event_audit
- CVE-2023-26036ZoneMinder contains Local File Inclusion vulnerability
- CVE-2023-26035ZoneMinder vulnerable to Missing Authorization
- CVE-2023-26034ZoneMinder SQL Injection
- CVE-2023-26032ZoneMinder contains SQL injection via malicious Jason Web Token
- CVE-2023-25825ZoneMinder contains Cross-site Scripting via log viewing
- CVE-2022-39291Denial of service through logs in zoneminder
- CVE-2022-39290CSRF key bypass using HTTP methods in zoneminder
- CVE-2022-39289Database log access in ZoneMinder
- CVE-2022-39285Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder