Known vulnerabilities in ZoneMinder

Vendor: ZoneMinder.com
Software: ZoneMinder
Software CPE: cpe:2.3:a:zoneminder_com:zoneminder:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 26
Public exploits: 7
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting ZoneMinder ZoneMinder is affected by 26 known vulnerabilities: 11 high, 6 medium, 9 low Critical High Medium Low

Vulnerabilities (26)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU133361 - Authorization Bypass Through User-Controlled Key
 CWE-639 Medium
Available
No
 1.36.39, 1.38.4, 1.39.11 04.06.2026 SB2026060474
#VU126828 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-27470		 CWE-89 Medium
No
No
 1.36.38, 1.38.1 22.04.2026 SB20260422185
#VU126826 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-65791		 CWE-78 High
No
No
 1.36.38, 1.38.1 22.04.2026 SB20260422185
#VU72703 - Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2023-2603		 CWE-98 High
No
No
 1.37.33 01.03.2023 SB2023030118
SB2023060126
SB2023061452
and 87 more
#VU72702 - Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2023-26036		 CWE-98 High
No
No
 1.36.33, 1.37.33 01.03.2023 SB2023030118
#VU72688 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-25825		 CWE-79 Low
No
No
 1.36.33, 1.37.33 01.03.2023 SB2023030118
#VU72687 - Improper Control of Generation of Code ('Code Injection')
CVE-2023-26035		 CWE-94 High
Available
No
 1.36.33, 1.37.33 01.03.2023 SB2023030118
#VU72684 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-26032		 CWE-89 High
No
No
 1.36.33, 1.37.33 01.03.2023 SB2023030118
#VU72682 - Command injection
CVE-2023-26039		 CWE-77 Medium
No
No
 1.36.33, 1.37.33 01.03.2023 SB2023030118
#VU72681 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-26037		 CWE-89 High
No
No
 1.36.33, 1.37.33 01.03.2023 SB2023030118
#VU72677 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-26034		 CWE-89 Medium
No
No
 1.36.33, 1.37.33 01.03.2023 SB2023030118
#VU68392 - Security Features
CVE-2022-39289		 CWE-254 High
No
No
 1.36.27, 1.37.24 18.10.2022 SB2022101836
#VU68391 - Improper input validation
CVE-2022-39291		 CWE-20 Low
Available
No
 1.36.27, 1.37.24 18.10.2022 SB2022101836
#VU68388 - Cross-Site Request Forgery (CSRF)
CVE-2022-39290		 CWE-352 Low
Available
No
 1.36.27, 1.37.24 18.10.2022 SB2022101836
#VU68386 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-39285		 CWE-79 Low
Available
No
 1.36.27, 1.37.24 18.10.2022 SB2022101836
#VU36125 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-8425		 CWE-79 Low
No
No
 1.32.3 18.02.2019 SB2019021823
#VU36126 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-8426		 CWE-79 Low
No
No
 1.32.3 18.02.2019 SB2019021823
#VU36127 - Command injection
CVE-2019-8427		 CWE-77 High
No
No
 1.32.3 18.02.2019 SB2019021823
#VU36128 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2019-8428		 CWE-89 High
No
No
 1.32.3 18.02.2019 SB2019021823
#VU36129 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2019-8429		 CWE-89 High
No
No
 1.32.3 18.02.2019 SB2019021823


Showing elements 1 - 20 out of 26