CVE-2024-45699

CVE-2024-45699 affects Zabbix frontend: /zabbix.php?action=export.valuemaps is vulnerable to XSS via the backurl parameter due to reflecting user input without HTML escaping. Impact described as JavaScript execution in victim browser. Remediation is version-specific updates across distributions (...

CVE-2024-45699 Reflected XSS vulnerability in /zabbix.php?action=export.valuemaps

The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the abo...

CVE-2024-45699

The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the abo...

CVE-2024-42325 Excessive information returned by user.get

Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc...

CVE-2024-42325

CVE-2024-42325 affects Zabbix: the API method user.get may disclose information by returning all users who share a group with the caller, including media and login attempts. The connected sources confirm this disclosure vector and map it to multiple vendor advisories. Publicly documented mitigati...

CVE-2024-42325

Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc...

CVE-2024-42325 Excessive information returned by user.get

Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc...

CVE-2024-36469 User enumeration via timing attack in Zabbix web interface

Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one...

CVE-2024-36469

CVE-2024-36469 affects Zabbix across multiple distributions. The issue is described as a timing discrepancy: execution time for an unsuccessful login differs between non-existent vs. existing usernames. Connected advisories confirm affected packages and vendor-supplied patches: Debian LTS DLA-413...

CVE-2024-36469 User enumeration via timing attack in Zabbix web interface

Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one...

CVE-2024-36465 SQL injection in Zabbix API

A low privilege regular Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter...

CVE-2024-36465

A low privilege regular Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter...

CVE-2024-36465 SQL injection in Zabbix API

A low privilege regular Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter...

CVE-2024-36465

CVE-2024-36465 affects Zabbix where a low-privilege regular user with API access can abuse an SQL injection in include/classes/api/CApiService.php via the groupBy parameter to execute arbitrary SQL commands. The underlying issue is improper handling of the groupBy input, enabling an attacker to c...

Zabbix 跨站脚本漏洞

Zabbix is an open source monitoring system from Zabbix. The system supports network monitoring, server monitoring, cloud monitoring, and application monitoring. A cross-site scripting vulnerability exists in Zabbix that originates in cross-site scripting and could result in a JavaScript payload...

Zabbix 安全漏洞

Zabbix is an open source monitoring system from Zabbix. The system supports network monitoring, server monitoring, cloud monitoring, and application monitoring. A security vulnerability exists in Zabbix that stems from returning all user information, including media and other information, that...

Zabbix SQL注入漏洞

Zabbix is an open source monitoring system from Zabbix. The system supports network monitoring, server monitoring, cloud monitoring and application monitoring. A security vulnerability exists in Zabbix that stems from SQL injection in the API service, which could lead to execution of arbitrary SQ...

Zabbix 安全漏洞

Zabbix is an open source monitoring system from Zabbix. The system supports network monitoring, server monitoring, cloud monitoring and application monitoring. Zabbix suffers from a security vulnerability that stems from uncontrolled resource exhaustion, which could lead to a service crash...

Zabbix 安全漏洞

Zabbix is an open source monitoring system from Zabbix. The system supports network monitoring, server monitoring, cloud monitoring and application monitoring. A security vulnerability exists in Zabbix that stems from a login failure with a non-existing username that has a different execution tim...

PT-2025-14462 · Zabbix +3 · Zabbix +3

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The endpoint "/zabbix.php?action=export.valuemaps" suffers from a Cross-Site Scripting issue via the backurl parameter. This is caused by the reflection of user-supplied data without...