CVE-2026-27470: Improper Neutralization of Special Elements used in an SQL Command

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

CVE-2019-8429

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...

CVE-2019-8429

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...

CVE-2019-8429

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...

CVE-2019-8424

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter...

CVE-2019-8424

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter...

Sql injection

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...

CVE-2019-8429

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...

Sql injection

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter...

CVE-2019-8429

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...

CVE-2019-8424

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter...

CVE-2019-8429: Improper Neutralization of Special Elements used in an SQL Command

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...

CVE-2019-8424

CVE-2019-8424 affects ZoneMinder before 1.32.3. It is a SQL Injection via the ajax/status.php sort parameter, potentially enabling unauthenticated remote attackers to manipulate queries. CVSS v3 base score 9.8 (CRITICAL) / NETWORK, LOW complexity, no user interaction. Remediation: upgrade ZoneMin...

CVE-2019-8429

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...

CVE-2019-8424

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter...

CVE-2019-8424: Improper Neutralization of Special Elements used in an SQL Command

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter...

PT-2019-19026

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.3 Description The issue allows for SQL Injection via the sort parameter in the "ajax/status.php" endpoint. Recommendations For versions prior to 1.32.3, update to version 1.32.3 or later to resolve the issue...

PT-2019-19031

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.3 Description The issue allows for SQL Injection via the ajax/status.php endpoint, specifically through the filterQueryterms0cnj parameter. Recommendations For versions prior to 1.32.3, update to version 1.32....