CVE-2025-47782 motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution

motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed camera device path with the add/addcamera motionEye web API allows an attacker with motionEye admin user credentials to execute...

CVE-2025-47782

MotionEye vulnerability CVE-2025-47782: in versions 0.43.1b1–0.43.1b3, an attacker with admin credentials can trigger remote code execution by crafting a malicious device path via the add/add_camera API, allowing arbitrary shell commands to run as the motion user. Root cause: unsafe command execu...

CVE-2025-47782 motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution

motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed camera device path with the add/addcamera motionEye web API allows an attacker with motionEye admin user credentials to execute...

PT-2025-21180 · Motioneye · Motioneye

Name of the Vulnerable Software and Affected Versions: motionEye versions 0.43.1b1 through 0.43.1b3 Description: The issue allows an attacker with admin user credentials to execute any command within a non-interactive shell as the motionEye run user, motion by default, by using a constructed devi...

motionEye 操作系统命令注入漏洞

motionEye is a daemon web front-end for motionEye open source. A security vulnerability exists in motionEye versions 0.43.1b1 through 0.43.1b3, which stems from a constructed device path that could lead to the execution of arbitrary commands as the motion user...

Information Disclosure

motioneye is vulnerable to information disclosure. The vulnerability exists due to an insecure access control allowing an attacker to access sensitive information via the GET request to web API /config/list endpoint when a user's password is not configured...

GHSA-2C7W-V459-CWGF MotionEye allows attackers to access sensitive information

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...

MotionEye allows attackers to access sensitive information

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...

CVE-2022-25568

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...

CVE-2022-25568

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...

PYSEC-2022-43141

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...

Design/Logic Flaw

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...

PYSEC-2022-43141

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...

CVE-2022-25568

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...

CVE-2022-25568

Summary of CVE-2022-25568 (MotionEye) : MotionEye versions 0.42.1 and earlier allow unauthenticated attackers to retrieve sensitive configuration data via a GET to /config/list when a regular user password is not configured. The risk arises from insufficient access controls on the /config/list en...

CVE-2022-25568

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...

PT-2022-17371 · Motioneye · Motioneye

Name of the Vulnerable Software and Affected Versions: MotionEye versions 0.42.1 and below Description: The issue allows attackers to access sensitive information via a GET request to "/config/list". To exploit this, a regular user password must be unconfigured. Recommendations: For MotionEye...

MotionEye-Project MotionEye 信息泄露漏洞

MotionEye-Project MotionEye is a web-based motion front-end from the individual developer Calin Crisan. A security vulnerability exists in MotionEye-Project MotionEye v0.42.1 and prior versions, which stems from the application's lack of permissions restriction and filtering for GET requests to...

Unrestricted Upload of File with Dangerous Type in motionEye

motionEye = 0.42.1 and motioneEyeOS = 20200606 allow a remote attacker to upload a configuration backup file containing a malicious python pickle file. This is possible when an installation is accessible over the Internet and uses no or poor authentication credentials. The GitHub repositories for...

GHSA-M2C7-42RF-C62F Unrestricted Upload of File with Dangerous Type in motionEye

motionEye = 0.42.1 and motioneEyeOS = 20200606 allow a remote attacker to upload a configuration backup file containing a malicious python pickle file. This is possible when an installation is accessible over the Internet and uses no or poor authentication credentials. The GitHub repositories for...