26 matches found
Zabbix 6.0.x < 6.0.41 / 7.0.x < 7.0.17 / 7.2.x < 7.2.11 Information Disclosure (ZBX-27060)
The version of Zabbix Server installed on the remote host is affected by a vulnerability. A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access...
CVE-2026-23921 Blind, read-only SQL injection in Zabbix API via sortfield parameter
A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data...
EUVD-2014-1756
Malware in sbrugna...
EUVD-2010-1306
Malware in sbrugna...
EUVD-2024-54347
Malicious code in bioql PyPI...
CVE-2025-27236
A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to...
Linux Distros Unpatched Vulnerability : CVE-2025-27238
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them. CVE-2025-27238 No...
UBUNTU-CVE-2025-27238
Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them...
CVE-2025-27238
CVE-2025-27238 is due to a bug in the Zabbix API where hostprototype.get incorrectly lists all host prototypes to users who have no user groups assigned. The issue arises from the API’s handling of authorization, potentially exposing prototype data to unauthorized users. Connected sources corrobo...
Linux Distros Unpatched Vulnerability : CVE-2024-42325
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc...
CVE-2024-42325
Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc...
CVE-2024-42325
Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc...
CVE-2024-42325
Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc...
CVE-2024-42325 Excessive information returned by user.get
Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc...
CVE-2024-42325 Excessive information returned by user.get
Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc...
CVE-2024-42325
CVE-2024-42325 affects Zabbix: the API method user.get may disclose information by returning all users who share a group with the caller, including media and login attempts. The connected sources confirm this disclosure vector and map it to multiple vendor advisories. Publicly documented mitigati...
CVE-2024-36465 SQL injection in Zabbix API
A low privilege regular Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter...
CVE-2024-36465 SQL injection in Zabbix API
A low privilege regular Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter...
PT-2025-14461
Name of the Vulnerable Software and Affected Versions Zabbix affected versions not specified Description The issue concerns the Zabbix API, specifically the "user.get" endpoint, which returns all users that share a common group with the calling user. This includes sensitive information such as...
Exploit for CVE-2024-42327
PoC and Exploit for CVE-2024-42327 / ZBX-25623 A non-admin us...