ZoneMinder vulnerabilities
We track 17 vulnerabilities in ZoneMinder products. 17 are rated high or critical, and none are known to be exploited. The most recent was published on October 16, 2026.
Latest ZoneMinder vulnerabilities
- 8.8 High severity
zoneminder: Improper Neutralization of Special Elements used in an OS Command
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user wit
- 9.0 Critical severity
zoneminder: Improper Neutralization of Special Elements used in an OS Command
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with moni
- 8.8 High severity
zoneminder: Improper Neutralization of Special Elements used in an OS Command
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when
- 8.8 High severity
Zoneminder: Improper Neutralization of Special Elements used in an OS Command
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events
- 8.8 High severity
ZoneMinder: Improper Neutralization of Special Elements used in an OS Command
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\User class,
- 8.8 High severity
zoneminder: Improper Neutralization of Special Elements used in an SQL Command
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function.
- 9.8 Critical severity
Zoneminder: Improper Neutralization of Special Elements used in an OS Command
ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. NOTE: this is disputed by the Supplier because there is no unsanitized user input to web/views/image.p
- 9.9 Critical severity
zoneminder: Improper Neutralization of Special Elements used in an SQL Command
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* <= 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is fixed in 1.37.65.
- 9.8 Critical severity
zoneminder: Improper Neutralization of Special Elements used in an SQL Command
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.
- 8.8 High severity
zoneminder: Improper Neutralization of Special Elements used in an OS Command
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl() in (/web/api/app/Controller/HostCont
- 9.8 Critical severity
zoneminder: Improper Neutralization of Special Elements used in an SQL Command
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an SQL Injection. The minTime and maxTime request parameters are not properly va
- 9.8 Critical severity
zoneminder: Untrusted Search Path
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via /web/index.php.
- 9.8 Critical severity
zoneminder: Missing Authorization
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There
- 8.8 High severity
zoneminder: Improper Neutralization of Special Elements used in an SQL Command
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are affected by a SQL Injection vulnerability. The (blind) SQL Injection vulnerability i
- 8.1 High severity
zoneminder: Improper Neutralization of Special Elements used in an SQL Command
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain SQL Injection via malicious jason web token. The Username field of the JWT token
- 7.5 High severity
zoneminder: Missing Authorization
ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. User
- 9.8 Critical severity
Zoneminder: Improper Limitation of a Pathname to a Restricted Directory
ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to exploitability.