53 matches found
CVE-2026-102607-ZoneMinder
Security Vulnerability Report: OS Command Injection in ZoneMinder exportEvents Summary An authenticated OS Command Injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec,...
CVE-2026-102607
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events...
CVE-2026-102607
ZoneMinder is vulnerable to authenticated OS command injection (RCE) in versions prior to 1.38.3 , specifically affecting the exportEvents() function. The root cause is the direct concatenation of the unsanitized exportFile request parameter into a shell command executed via PHP's exec() without ...
CVE-2026-102607
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events...
EUVD-2026-103146
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events...
CVE-2026-102607 ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events...
CVE-2026-102607 ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events...
CVE-2026-102607: Improper Neutralization of Special Elements used in an OS Command
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events...
PT-2026-116143
Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.38.3 Description The exportEvents function fails to neutralize shell metacharacters when processing the exportFile request parameter. An authenticated user with View Events or View Snapshots permissions can explo...
Linux Distros Unpatched Vulnerability : CVE-2026-76060
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitiz...
CVE-2026-76060
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...
DEBIAN-CVE-2026-76060
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...
UBUNTU-CVE-2026-76060
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...
CVE-2026-76060
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...
CVE-2026-76060: Improper Neutralization of Special Elements used in an OS Command
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...
CVE-2026-76060 OS Command Injection in PayRange API
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...
CVE-2026-76060
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...
CVE-2026-76060 OS Command Injection in PayRange API
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...
CVE-2026-76060 OS Command Injection in PayRange API
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...
CVE-2026-76060
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...