CVE-2025-60787

CVE-2025-60787 - Authenticated RCE in motionEye PoC for CVE-2025-60787 that is an Authenticated RCE vulnerability for motionEye with all afected versions up to 0.43.1b4 included. This is an automated PoC for the vulnerability described in this repository. Credits to prabhatverma47. Usage The scri...

CVE-2025-60787_PoC

CVE-2025-60787 - MotionEye RCE Authenticated RCE in MotionEye = 0.43.1b4 via client-side validation bypass on the imagefilename field. Usage root@kitploit: nc -lvnp 4444 python exploit.py -t http://127.0.0.1:8765 -p password -lh IP -lp 4444 Flags...

motionEye-RCE-through-config-parameter

MotionEye RCE via Client-Side Validation Bypass Summary During security testing of a MotionEye instance running in Docker, it was observed that client-side validation within the web UI can be bypassed. This allows arbitrary input to be submitted, including payloads that can trigger execution on t...

cctv

CCTV — HackTheBox 演练 平台： HackTheBox | 操作系统： Linux 攻击链 通过 CVE-2024-51482 对 ZoneMinder 进行 SQL 注入，从数据库中导出 bcrypt 哈希。使用 hashcat 破解后获得 SSH 访问权限。通过端口转发暴露的内部 motionEye 实例存在 CVE-2025-60787 漏洞——可获取 root shell。 枚举 root@kitploit: nmap -sV -sC 10.129.53.160 -Pn 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 80/tcp ope...

MotionEye Config Info Disclosure

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured. id: CVE-2022-25568 info: name: MotionEye Config Info Disclosure author: DhiyaneshDK severity: high...

CVE-2025-60787

CVE-2025-60787 — motionEye Authenticated RCE Authenticated command injection PoC for CVE-2025-60787. motionEye v0.43.1b4 and earlier write user-controlled camera configuration values such as imagefilename into Motion configuration without sufficient sanitization, allowing command execution when t...

motioneye-authenticated-RCE

MotionEye/MotionEyeOS Authenticated RCE A Python 3 script that uploads a tasks.pickle file that enables RCE in MotionEye. You need administrator credentials, so it should not be that big of a deal. Unfortunately, MotionEye/MotionEyeOS can frequently be found running with default credentials...

CVE-2025-60787-MotionEye-RCE

CVE-2025-60787: Motioneye リモートコード実行 RCE CVE-2025-60787 のプロフェッショナルな概念実証 PoC です。MotionEye バージョン ≤ 0.43.1b4 における重大なリモートコード実行 RCE 脆弱性です。 技術概要 この脆弱性は、configUiValid JavaScript 関数におけるクライアント側のバリデーションのバイパスに起因します。UI はファイル名フィールドを検証しますが、サーバー側は camera-N.conf ファイルに書き込む前にこれらの入力を適切にサニタイズできません。攻撃者は imagefilename...

CVE-2025-60787-POC

CVE-2025-60787 - motionEye 認証済みRCE motionEye = 0.43.1b4 における、サニタイズされていない motion 設定パラメータを介した認証済みリモートコード実行 著者: d3vn0mi 脆弱性概要...

CVE-2025-60787-Detection-motionEye-RCE-via-Config-Injection

README.md CVE-2025-60787 Detection: motionEye RCE via Config Injection Unauthenticated Remote Code Execution in motionEye Still Images - Image File Name Example PoC payload: root@kitploit: $touch /tmp/test.%Y-%m-%d-%H-%M-%S When motion restarts, the shell command executes and creates /tmp/test...

CVE-2025-60787

CVE-2025-60787 CVE-2025-60787 Poc - RCE - MotionEye = 0.43.1b4 Enlace original: https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter MotionEye RCE mediante omisión de validación del lado del cliente Resumen Durante las pruebas de seguridad de una instancia de MotionEye...

CVE-2025-60787

CVE-2025-60787 - MotionEye RCE MotionEye v0.43.1b4 OS Command Injection A proof-of-concept exploit OS Command Injection for vulnerability in motionEye, a web frontend for the motion daemon. The vulnerability abuses the imagefilename configuration parameter, which is passed directly to the shell...

PYSEC-2026-2665 motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution

Summary The ActionHandler.post method in motionEye has no authentication decorator, allowing any unauthenticated attacker to trigger camera actions including snapshots, recording start/stop, and configured action scripts PTZ controls, alarm triggers, etc.. Vulnerability Details File:...

PYSEC-2026-2667 motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read

Summary mEye contains an absolute path traversal vulnerability in multiple media file handlers that allows an attacker to read arbitrary files from the filesystem. The affected handlers accept a user-controlled filename parameter and construct filesystem paths using os.path.join. When an absolute...

PYSEC-2026-2664 motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint

Summary motionEye v0.43.1 latest stable is vulnerable to path traversal in the picture and movie API endpoints, like /picture/id/preview/filename. Neither the API handlers, nor the mediafiles.py functions like getmediapreview check for .. sequences in the filename parameter, except getmediaconten...

PYSEC-2026-2666 motionEye's World-Readable Configuration File Exposes Admin Password Hash

Security Advisory: World-Readable Configuration File Exposes Admin Password Hash in motionEye Summary motionEye v0.43.1 and prior versions create the configuration file /etc/motioneye/motion.conf with 644 permissions -rw-r--r--, making it readable by any local user on the system. This file contai...

PYSEC-2026-1680 motionEye vulnerable to RCE via unsanitized motion config parameter

Summary A command injection vulnerability in MotionEye allows attackers to achieve Remote Code Execution RCE by supplying malicious values in configuration fields exposed via the Web UI. Because MotionEye writes user-supplied values directly into Motion configuration files without sanitization,...

PYSEC-2026-681 Unrestricted Upload of File with Dangerous Type in motionEye

motionEye = 0.42.1 and motioneEyeOS = 20200606 allow a remote attacker to upload a configuration backup file containing a malicious python pickle file. This is possible when an installation is accessible over the Internet and uses no or poor authentication credentials. The GitHub repositories for...

PYSEC-2026-428 motionEye: Authentication possible via password hash

Summary An authentication bypass vulnerability exists due to improper trust in client-controlled cookies. The application accepts user-supplied cookie values containing a username and password-hash-derived value as sufficient authentication material. These cookies can be set or modified prior to...

CVE-2026-32315

motionEye mEye is an online interface for motion software, a video surveillance program with motion detection. Versions prior to 0.44.0 create the configuration file /etc/motioneye/motion.conf with 644 permissions -rw-r--r--, making it readable by any local user on the system. This file contains...