Known vulnerabilities in ZoneMinder

Vendor: ZoneMinder.com
Software: ZoneMinder
Software CPE: cpe:2.3:a:zoneminder_com:zoneminder:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 75
Public exploits: 7
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting ZoneMinder ZoneMinder is affected by 75 known vulnerabilities: 17 high, 25 medium, 33 low Critical High Medium Low

Vulnerabilities (75)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU126828 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-27470		 CWE-89 Medium
No
No
 1.36.38, 1.38.1 22.04.2026 SB20260422185
#VU126826 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-65791		 CWE-78 High
No
No
 1.36.38, 1.38.1 22.04.2026 SB20260422185
#VU72682 - Command injection
CVE-2023-26039		 CWE-77 Medium
No
No
 1.36.33, 1.37.33 01.03.2023 SB2023030118
#VU72681 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-26037		 CWE-89 High
No
No
 1.36.33, 1.37.33 01.03.2023 SB2023030118
#VU72677 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-26034		 CWE-89 Medium
No
No
 1.36.33, 1.37.33 01.03.2023 SB2023030118
#VU68392 - Security Features
CVE-2022-39289		 CWE-254 High
No
No
 1.36.27, 1.37.24 18.10.2022 SB2022101836
#VU68391 - Improper input validation
CVE-2022-39291		 CWE-20 Low
Available
No
 1.36.27, 1.37.24 18.10.2022 SB2022101836
#VU68388 - Cross-Site Request Forgery (CSRF)
CVE-2022-39290		 CWE-352 Low
Available
No
 1.36.27, 1.37.24 18.10.2022 SB2022101836
#VU68386 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-39285		 CWE-79 Low
Available
No
 1.36.27, 1.37.24 18.10.2022 SB2022101836
#VU35771 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-13072		 CWE-79 Low
No
No
 - 30.06.2019 SB2019012432
#VU36124 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2019-8424		 CWE-89 High
No
No
 1.32.3 18.02.2019 SB2019021823
#VU36125 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-8425		 CWE-79 Low
No
No
 1.32.3 18.02.2019 SB2019021823
#VU36126 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-8426		 CWE-79 Low
No
No
 1.32.3 18.02.2019 SB2019021823
#VU36127 - Command injection
CVE-2019-8427		 CWE-77 High
No
No
 1.32.3 18.02.2019 SB2019021823
#VU36128 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2019-8428		 CWE-89 High
No
No
 1.32.3 18.02.2019 SB2019021823
#VU36129 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2019-8429		 CWE-89 High
No
No
 1.32.3 18.02.2019 SB2019021823
#VU36189 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-6777		 CWE-79 Low
No
No
 - 24.01.2019 SB2019012432
#VU39419 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2017-7203		 CWE-79 Low
No
No
 - 21.03.2017 SB2017032109
#VU42983 - Improper input validation
CVE-2013-0232		 CWE-20 Medium
Available
No
 - 20.03.2013 SB2013032005
#VU42984 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2013-0332		 CWE-22 Medium
Available
No
 - 20.03.2013 SB2013032006


Showing elements 1 - 20 out of 75