CloudMap 漏洞情报库

低危2026/07/19

ZoneMinder System Log - Detect

ZoneMinder system log file exposed.

CVSS—

严重CVE-2024-514822024/11/29

ZoneMinder v1.37.* <= 1.37.64 - SQL Injection

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* <= 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is fixed in 1.37.65.

zoneminderPoC 已收录

CVSS9.9EPSS 20.9%

严重CVE-2024-433602024/05/23

ZoneMinder - SQL Injection

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.

zoneminderPoC 已收录

CVSS9.8EPSS 62.0%

严重CVE-2023-260352023/02/25

ZoneMinder Snapshots - Command Injection

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id.

zoneminderPoC 已收录EXP 已收录RCE

CVSS9.8EPSS 50.7%

严重CVE-2022-298062022/04/26

CVE-2022-29806

ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to exploitability.

zoneminderRCE

CVSS9.8EPSS 87.2%

高危CVE-2013-02322013/03/20

CVE-2013-0232

includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.