CVE-2026-23921

CVE-2026-23921 — Zabbix Time-Based Blind SQL Injection Affected versions: Zabbix 50 THEN pgsleep3 ELSE pgsleep0 END-- Usage PostgreSQL backend d...

Blind SQL Injection

Zabbix is vulnerable to blind SQL injection. The vulnerability is due to improper sanitization of the sortfield parameter in include/classes/api/CApiService.php, which allows a low-privileged user with API access to execute arbitrary SQL select queries and exfiltrate database data through...

DEBIAN-CVE-2024-36465

A low privilege regular Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter...