CVE-2026-72556

Removed by vendor...

zoneminder v1.38.4

ZoneMinder All documentation for ZoneMinder is now online at https://zoneminder.readthedocs.org Overview ZoneMinder is an integrated set of applications which provide a complete surveillance solution allowing capture, analysis, recording and monitoring of any CCTV or security cameras attached to ...

PT-2026-70131

Name of the Vulnerable Software and Affected Versions ZoneMinder version 1.39.17 Description An authenticated user can execute OS commands due to a broken permission check within the Filter class. The canEdit and canDelete functions call nonexistent methods on the ZMUser class, which triggers the...

CVE-2026-72556: Improper Neutralization of Special Elements used in an OS Command

A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit and canDelete methods invoke nonexistent methods on the ZM\User class, causing PHP call to return a truthy valu...

ZoneMinder - /events/ Listing Detection (CVE-2016-10140)

Detects CVE-2016-10140 by requesting /events/ and matching Apache-style Index of./events directory listing. !/usr/bin/env python3 -- coding: utf-8 -- """ZoneMinder /events/ directory listing disclosure CVE-2016-10140.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

ZoneMinder Login Panel - Detect

ZoneMinder panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """ZoneMinder panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ZoneMinder Login Panel - Detect', 'description': 'ZoneMinder...

ZoneMinder CVE-2026-27470 second-order SQLi

Exploits CVE-2026-27470: authenticated second-order SQL injection in ZoneMinder getNearEvents web/ajax/status.php. Stores a UNION payload in Event Name/Cause parameterized write, then triggers via entity=nearevents. Affected: = 1.36.37 and 1.37.61–1.38.0. Fixed: 1.36.38 / 1.38.1. Requires Events...

Exploit for OS Command Injection in Zoneminder

CVE-2023-26039 Description ZoneMinder is a free, open sou...

Exploit for CVE-2024-51482

CVE-2024-51482 — ZoneMinder Time-Based Blind SQL Injection A...

zoneminder-rce-poc

just wait and see Proof of concept for an OS command injectio...

ffensive-playbook

HackTheBox — Writeups Collection A collection of HackTheBox m...

ofensive-playbook

HackTheBox — Writeups Collection A collection of HackTheBox m...

Exploit for Allocation of Resources Without Limits or Throttling in Espressif Esp-Idf

CVE-2024-51428 - ZoneMinder Blind SQL Injection PoC Python wr...

Exploit for CVE-2024-51482

ZoneMinder Time-Based SQL Injection CVE-2024-51482 📌 Vul...

Exploit for CVE-2024-51482

CVE-2024-51482-PoC Authenticated time-based blind SQL injecti...

CVE-2026-27470

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

Exploit for CVE-2026-27470

CVE-2026-27470 — ZoneMinder Second-Order SQL Injection !CVE...

CVE-2026-27470

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

CVE-2026-27470

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

CVE-2026-27470 ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...