Motioneye-project vulnerabilities
We track 5 vulnerabilities in Motioneye-project products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 15, 2026.
Latest Motioneye-project vulnerabilities
- 9.1 Critical severity
motioneye: Plaintext Storage of a Password
motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meye_username and meye_password_hash cookies as authenticatio
- 7.7 High severity
motioneye: Improper Limitation of a Pathname to a Restricted Directory
motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Versions prior to 0.44.0 contain an absolute path traversal vulnerability in multiple media file handlers that allows
- 7.2 High severity
MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration…
MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code
- 8.9 High severity
motioneye: Improper Neutralization of Special Elements used in an OS Command
motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with
- 7.5 High severity
Motioneye: Initialization of a Resource with an Insecure Default
MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured.