SQL injection in ZoneMinder - #VU158964
Published: November 3, 2026
Vulnerability identifier: #VU158964
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary SQL queries with the ZoneMinder database daemon's credentials, disclose sensitive database contents, and manipulate recorded events.
The vulnerability exists due to improper neutralization of stored filter attributes and values in ZoneMinder's Filter.pm when the zmfilter.pl daemon constructs SQL queries by concatenating filter terms retrieved from Filters.Query_json. A remote user can save a malicious event filter with an automatic action enabled to inject SQL that the background daemon subsequently executes, exposing password hashes and API tokens and allowing unauthorized event manipulation.
Affected software
ZoneMinder
Remediation
Install security update from vendor's website.
ZoneMinder - update to 1.38.5