Known vulnerabilities in ZoneMinder - page 2

Vendor: ZoneMinder.com
Software: ZoneMinder
Software CPE: cpe:2.3:a:zoneminder_com:zoneminder:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 75
Public exploits: 7
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting ZoneMinder ZoneMinder is affected by 75 known vulnerabilities: 17 high, 25 medium, 33 low Critical High Medium Low

Vulnerabilities (75)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU158944 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.38.4 03.11.2026 SB2026060474
#VU158943 - Server-Side Request Forgery (SSRF)
 CWE-918 Low
No
No
 1.38.4 03.11.2026 SB2026060474
#VU158942 - Missing Authorization
 CWE-862 Low
No
No
 1.38.4 03.11.2026 SB2026060474
#VU158939 - Server-Side Request Forgery (SSRF)
 CWE-918 Low
No
No
 1.38.4 03.11.2026 SB2026060474
#VU158937 - Incorrect Comparison
CVE-2026-104198		 CWE-697 High
No
No
 1.38.2 03.11.2026 SB2026110377
#VU158935 - Incorrect Authorization
CVE-2026-102297		 CWE-863 Low
No
No
 1.38.4 03.11.2026 SB2026060474
#VU158934 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-76060		 CWE-78 Medium
No
No
 1.38.3 03.11.2026 SB2026110376
#VU158932 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-102607		 CWE-78 Medium
No
No
 1.38.3 03.11.2026 SB2026110376
#VU133361 - Authorization Bypass Through User-Controlled Key
CVE-2026-54258		 CWE-639 Medium
Available
No
 1.36.39, 1.38.4, 1.39.11 04.06.2026 SB2026060474
#VU158931 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-51482		 CWE-89 Medium
No
No
 1.37.65 31.10.2024 SB20241031113
#VU158930 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-43360		 CWE-89 High
No
No
 1.36.33 12.08.2024 SB2023030118
#VU158929 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-43359		 CWE-79 Medium
No
No
 1.36.34, 1.37.61 12.08.2024 SB2024081258
#VU158928 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-43358		 CWE-79 Medium
No
No
 1.36.34, 1.37.61 12.08.2024 SB2024081258
#VU158927 - Command injection
 CWE-77 Low
No
No
 1.36.34 12.08.2024 SB2024081258
#VU72703 - Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2023-2603		 CWE-98 High
No
No
 1.37.33 01.03.2023 SB2023030118
SB2023060126
SB2023061452
and 87 more
#VU72702 - Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2023-26036		 CWE-98 High
No
No
 1.36.33, 1.37.33 01.03.2023 SB2023030118
#VU72688 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-25825		 CWE-79 Low
No
No
 1.36.33, 1.37.33 01.03.2023 SB2023030118
#VU72687 - Improper Control of Generation of Code ('Code Injection')
CVE-2023-26035		 CWE-94 High
Available
No
 1.36.33, 1.37.33 01.03.2023 SB2023030118
#VU72684 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-26032		 CWE-89 High
No
No
 1.36.33, 1.37.33 01.03.2023 SB2023030118
#VU158926 - Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2023-26038		 CWE-98 Low
No
No
 1.36.33, 1.37.33 24.02.2023 SB2023030118


Showing elements 21 - 40 out of 75