en
The ZoneMinder project develops ZoneMinder, free and open-source video-surveillance software for Linux. Its software supports IP, USB, and analog cameras and provides video capture, analysis, recording, and monitoring for closed-circuit television deployments.
As of 09/14/2026, ZoneMinder recorded 3 security vulnerabilities in the last 90 days across 1 products, including 2 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, zoneminder had the most security vulnerabilities in the ZoneMinder ecosystem, with 3 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-54258Cross-monitor event media authorization bypass in direct event media endpoints | Exploitation statusNot confirmed | FixNot confirmed | Affected productzoneminder | Published09/11/2026 | SeverityMedium |
CVE-2026-76060OS Command Injection in PayRange API | Exploitation statusNot known exploited | FixYes | Affected productzoneminder | Published08/27/2026 | SeverityHigh |
CVE-2026-72556ZoneMinder ZoneMinder - Remote Code Execution | Exploitation statusNot known exploited | FixNot confirmed | Affected productzoneminder | Published08/11/2026 | SeverityHigh |
CVE-2026-27470ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields | Exploitation statusPublic exploit | FixNot confirmed | Affected productzoneminder | Published02/21/2026 | SeverityHigh |
CVE-2025-65791 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published02/18/2026 | SeverityCritical |
CVE-2024-51482Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64 | Exploitation statusPublic exploit | FixYes | Affected productzoneminder | Published10/31/2024 | SeverityCritical |
CVE-2023-31493 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published10/15/2024 | SeverityMedium |
CVE-2024-43360ZoneMinder Time-based SQL Injection | Exploitation statusPublic exploit | FixYes | Affected productzoneminder | Published08/12/2024 | SeverityCritical |
CVE-2024-43359XSS vulnerabilities in montagereview | Exploitation statusNot known exploited | FixYes | Affected productzoneminder | Published08/12/2024 | SeverityInformational |
CVE-2024-43358XSS vulnerability in filter view | Exploitation statusNot known exploited | FixYes | Affected productzoneminder | Published08/12/2024 | SeverityMedium |
CVE-2023-41884ZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.php | Exploitation statusPublic exploit | FixYes | Affected productzoneminder | Published08/12/2024 | SeverityHigh |
CVE-2020-25730 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published04/04/2024 | SeverityHigh |
CVE-2023-26039ZoneMinder vulnerable to OS Command injection in daemonControl() API | Exploitation statusNot known exploited | FixYes | Affected productzoneminder | Published02/25/2023 | SeverityHigh |
CVE-2023-26038ZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php` | Exploitation statusPublic exploit | FixYes | Affected productzoneminder | Published02/25/2023 | SeverityMedium |
CVE-2023-26037ZoneMinder contains SQL Injection via report_event_audit | Exploitation statusNot known exploited | FixYes | Affected productzoneminder | Published02/25/2023 | SeverityHigh |
CVE-2023-26036ZoneMinder contains Local File Inclusion vulnerability | Exploitation statusPublic exploit | FixYes | Affected productzoneminder | Published02/25/2023 | SeverityHigh |
CVE-2023-26035ZoneMinder vulnerable to Missing Authorization | Exploitation statusNot confirmed | FixYes | Affected productzoneminder | Published02/25/2023 | SeverityHigh |
CVE-2023-26034ZoneMinder SQL Injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productzoneminder | Published02/25/2023 | SeverityCritical |
CVE-2023-26032ZoneMinder contains SQL injection via malicious Jason Web Token | Exploitation statusNot known exploited | FixYes | Affected productzoneminder | Published02/25/2023 | SeverityHigh |
CVE-2023-25825ZoneMinder contains Cross-site Scripting via log viewing | Exploitation statusPublic exploit | FixYes | Affected productzoneminder | Published02/25/2023 | SeverityHigh |
CVE-2022-30769 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published11/15/2022 | SeverityMedium |
CVE-2022-30768 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published11/15/2022 | SeverityMedium |
CVE-2022-39290CSRF key bypass using HTTP methods in zoneminder | Exploitation statusPublic exploit | FixNot confirmed | Affected productzoneminder | Published10/07/2022 | SeverityHigh |
CVE-2022-39291Denial of service through logs in zoneminder | Exploitation statusPublic exploit | FixNot confirmed | Affected productzoneminder | Published10/07/2022 | SeverityMedium |
CVE-2022-39285Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder | Exploitation statusPublic exploit | FixNot confirmed | Affected productzoneminder | Published10/07/2022 | SeverityHigh |
CVE-2022-39289Database log access in ZoneMinder | Exploitation statusPublic exploit | FixNot confirmed | Affected productzoneminder | Published10/07/2022 | SeverityCritical |
CVE-2022-29806 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/26/2022 | SeverityUnknown |
CVE-2020-25729 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/17/2020 | SeverityUnknown |
CVE-2019-13072 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/30/2019 | SeverityUnknown |
CVE-2019-8427 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/18/2019 | SeverityUnknown |
CVE-2019-8425 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/18/2019 | SeverityUnknown |
CVE-2019-8428 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/18/2019 | SeverityUnknown |
CVE-2019-8426 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/18/2019 | SeverityUnknown |
CVE-2019-8424 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/18/2019 | SeverityUnknown |
CVE-2019-8429 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/18/2019 | SeverityUnknown |
CVE-2019-8423 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/18/2019 | SeverityUnknown |
CVE-2019-7334 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7329 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7333 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7335 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7347 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7327 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7339 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7342 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7337 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7351 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7325 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7349 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7341 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7338 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7352 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7340 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7348 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7344 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7345 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7331 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7350 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7332 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7343 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7336 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7330 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7346 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7328 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-7326 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2019 | SeverityUnknown |
CVE-2019-6992 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/28/2019 | SeverityUnknown |
CVE-2019-6990 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/28/2019 | SeverityUnknown |
CVE-2019-6991 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/28/2019 | SeverityUnknown |
CVE-2019-6777 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/24/2019 | SeverityUnknown |
CVE-2018-1000832 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/20/2018 | SeverityUnknown |
CVE-2018-1000833 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/20/2018 | SeverityUnknown |
CVE-2017-7203 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/21/2017 | SeverityUnknown |
CVE-2016-10206 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/03/2017 | SeverityUnknown |
CVE-2016-10202 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/03/2017 | SeverityUnknown |
CVE-2016-10204 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/03/2017 | SeverityUnknown |
CVE-2016-10201 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/03/2017 | SeverityUnknown |
CVE-2016-10203 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/03/2017 | SeverityUnknown |
CVE-2016-10205 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/03/2017 | SeverityUnknown |
CVE-2017-5595 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/06/2017 | SeverityUnknown |
CVE-2017-5368 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/06/2017 | SeverityUnknown |
CVE-2017-5367 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/06/2017 | SeverityUnknown |
CVE-2016-10140 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/13/2017 | SeverityUnknown |
CVE-2013-0232 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published03/20/2013 | SeverityUnknown |
CVE-2013-0332 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/20/2013 | SeverityUnknown |
CVE-2008-6756 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/27/2009 | SeverityUnknown |
CVE-2008-6755 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/27/2009 | SeverityUnknown |
CVE-2008-3881 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/02/2008 | SeverityUnknown |
CVE-2008-3882 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/02/2008 | SeverityUnknown |
CVE-2008-3880 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/02/2008 | SeverityUnknown |
CVE-2008-1381 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/01/2008 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
