# cve.now: Zoneminder

The newest entries naming Zoneminder as an affected vendor (up to 200), of 28 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-30971](https://cve.now/CVE-2026-30971.md): ZoneMinder: Authenticated RCE via command injection in monitor Device Path (CVSS 8.8)
- [CVE-2026-102608](https://cve.now/CVE-2026-102608.md): ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download\_functions.php) (CVSS 9.0)
- [CVE-2026-102607](https://cve.now/CVE-2026-102607.md): ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature (CVSS 8.8)
- [CVE-2026-104198](https://cve.now/CVE-2026-104198.md): ZoneMinder failed token handling bypasses web authentication (CVSS 5.3)
- [CVE-2026-102297](https://cve.now/CVE-2026-102297.md): ZoneMinder before 1.38.4 Incorrect Authorization in frames API index (CVSS 5.3)
- [CVE-2026-102296](https://cve.now/CVE-2026-102296.md): ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response (CVSS 8.3)
- [CVE-2024-58386](https://cve.now/CVE-2024-58386.md): ZoneMinder 1.37.x Path Traversal via files view (CVSS 7.1)
- [CVE-2026-54258](https://cve.now/CVE-2026-54258.md): Cross-monitor event media authorization bypass in direct event media endpoints (CVSS 6.5)
- [CVE-2026-76060](https://cve.now/CVE-2026-76060.md): OS Command Injection in PayRange API (CVSS 8.8)
- [CVE-2026-72556](https://cve.now/CVE-2026-72556.md): ZoneMinder ZoneMinder - Remote Code Execution (CVSS 8.8)
- [CVE-2026-27470](https://cve.now/CVE-2026-27470.md): ZoneMinder: Second-Order SQL Injection in \`getNearEvents()\` via Stored Event Name and Cause Fields (CVSS 8.8)
- [CVE-2024-51482](https://cve.now/CVE-2024-51482.md): Boolean-based SQL Injection in ZoneMinder v1.37.\* \<= 1.37.64 (CVSS 10.0)
- [CVE-2024-43360](https://cve.now/CVE-2024-43360.md): ZoneMinder Time-based SQL Injection (CVSS 9.8)
- [CVE-2024-43359](https://cve.now/CVE-2024-43359.md): XSS vulnerabilities in montagereview (CVSS 0.0)
- [CVE-2024-43358](https://cve.now/CVE-2024-43358.md): XSS vulnerability in filter view (CVSS 6.1)
- [CVE-2023-41884](https://cve.now/CVE-2023-41884.md): ZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.php (CVSS 7.1)
- [CVE-2023-26039](https://cve.now/CVE-2023-26039.md): ZoneMinder vulnerable to OS Command injection in daemonControl() API (CVSS 7.1)
- [CVE-2023-26038](https://cve.now/CVE-2023-26038.md): ZoneMinder contains Local File Inclusion vulnerability via \`web/ajax/modal.php\` (CVSS 5.4)
- [CVE-2023-26037](https://cve.now/CVE-2023-26037.md): ZoneMinder contains SQL Injection via report\_event\_audit (CVSS 8.9)
- [CVE-2023-26036](https://cve.now/CVE-2023-26036.md): ZoneMinder contains Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2023-26035](https://cve.now/CVE-2023-26035.md): ZoneMinder vulnerable to Missing Authorization (CVSS 7.2)
- [CVE-2023-26034](https://cve.now/CVE-2023-26034.md): ZoneMinder SQL Injection (CVSS 9.6)
- [CVE-2023-26032](https://cve.now/CVE-2023-26032.md): ZoneMinder contains SQL injection via malicious Jason Web Token (CVSS 8.9)
- [CVE-2023-25825](https://cve.now/CVE-2023-25825.md): ZoneMinder contains Cross-site Scripting via log viewing (CVSS 7.7)
- [CVE-2022-39291](https://cve.now/CVE-2022-39291.md): Denial of service through logs in zoneminder (CVSS 5.4)
- [CVE-2022-39290](https://cve.now/CVE-2022-39290.md): CSRF key bypass using HTTP methods in zoneminder (CVSS 8.0)
- [CVE-2022-39289](https://cve.now/CVE-2022-39289.md): Database log access in ZoneMinder (CVSS 9.1)
- [CVE-2022-39285](https://cve.now/CVE-2022-39285.md): Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder (CVSS 7.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/zoneminder
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.