zoneminder_CVE-2023-26035

Exploit - ZoneMinder CVE-2023-26035 There is a Unauthenticated Remote Code Execution RCE affecting ZoneMinder Snapshots. This is an exploit for CVE-2023-26035. Affected versions ZoneMinder 1.36.33 and ZoneMinder 1.37.33. Usage Check if the target is vulnerable: python3 zoneminder.py http://target...

CVE-2024-51482-PoC

CVE-2024-51482-PoC Authenticated time-based blind SQL injection exploit for ZoneMinder v1.37. = 1.37.64 Overview This is a proof-of-concept exploit for CVE-2024-51482, a time-based blind SQL injection vulnerability in ZoneMinder's event management functionality. The exploit requires authenticatio...

CVE-2024-51482

CVE-2024-51482 — ZoneMinder Time-Based Blind SQL Injection A proof-of-concept exploit for CVE-2024-51482 , an authenticated time-based blind SQL injection vulnerability in ZoneMinder v1.37. ≤ 1.37.64. The script extracts usernames and password hashes from the zm.Users table using binary search...

CVE-2024-51482

CVE-2024-51482 ZoneMinder v1.37. = 1.37.64 CVE-2024-51482 poc.py By default, this script enumerates the zm database, pulls from the Users table, and dumps Username+Password columns. If these 4 things exist, you will receive a username and password hash. More detailed information on the...

CVE-2026-76060_ZoneMinder_CommandInjection-PoC

just wait and see Proof of concept for an OS command injection vulnerability in ZoneMinder's event export functionality web/includes/downloadfunctions.php. Monitor names are interpolated directly into shell commands using manual single-quote wrapping instead of escapeshellarg. An attacker who can...

CVE-2026-27470-POC

CVE-2026-27470 — ZoneMinder Second-Order SQL Injection PoC Author:d3vn0mi | CVSS 8.8 | Authenticated | Events Permission Required Overview CVE-2026-27470 is a second-order SQL injection vulnerability in ZoneMinder's web/ajax/status.php — specifically the getNearEvents function. Detail| Value...

CVE-2026-27470

⚠️ YASAL UYARI / LEGAL DISCLAIMER Bu araç yalnızca eğitim amaçlı ve yazılı izin alınmış güvenlik testleri için geliştirilmiştir. Sahip olmadığınız veya test etmek için açık yazılı izniniz olmayan sistemlere karşı kullanılması yasadışıdır. Yetkisiz erişim, birçok ülkede ağır cezai yaptırımlara...

CVE-2022-29806

CVE-2022-29806 ZoneMinder up to 1.36.12 Language privilege escalation and RCE Description A Path Traversal vulnerability in debug log file and default language option in ZoneMinder version before 1.36.13 and 1.37.11 allows attackers to write and execute arbitrary code to achieve remote command...

zoneminder

ZoneMinder All documentation for ZoneMinder is now online at https://zoneminder.readthedocs.org Overview ZoneMinder is an integrated set of applications which provide a complete surveillance solution allowing capture, analysis, recording and monitoring of any CCTV or security cameras attached to ...

zoneminder-snapshots-rce-poc

Zoneminder Unauthenticated RCE via Snapshots CVE-2023-26035 POC This is a script written in Python that allows the exploitation of the Zoneminder's security flaw described in CVE-2023-26035. The system is vulnerable in versions preceding 1.36.33 and 1.37.33. Usage Clone the repository to your...

CVE-2026-102607-ZoneMinder

Security Vulnerability Report: OS Command Injection in ZoneMinder exportEvents Summary An authenticated OS Command Injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec,...

CVE-2024-51482-POC

ZoneMinder Authenticated Time Based SQLi POC - CVE-2024-51482 ⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal. Table of Contents ZoneMinder Authenticated Time Based SQLi POC - CVE-2024-51482...

CVE-2023-26035

CVE-2023-26035 ZoneMinder Snapshots - Unauthenticated Install Grab Repo $ git clone https://github.com/Yuma-Tsushima07/CVE-2023-26035.git Setup Note: Install the latest version of node $ npm init $ npm i axios cheerio yargs Usage ┌─✗─v37r1x@7h3B14ckKn1gh75─/Documents/Code/CVE-2023-26035 └──╼ $nod...

ZoneMinder Snapshots - Command Injection

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the...

ZoneMinder - SQL Injection

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61. id: CVE-2024-43360 info: name: ZoneMinder - SQL Injection author: s4e-io severity: critical...

zoneminder-1.29-1.30-rce-exploit

ZoneMinder 1.29/1.30 SQLi to RCE Exploit A ready-to-run Python exploit for ZoneMinder 1.29/1.30 that chains the unauthenticated SQL injection CVE-2016-10204 , EDB-41239 all the way to an interactive reverse shell. This is a weaponized/automated PoC for a known, patched CVE, not a new exploit. EDB...

CVE-2025-65791

CVE-2025-65791 — Command Injection in ZoneMinder Overview A critical Command Injection vulnerability exists in ZoneMinder v1.36.34 due to improper input validation in the web/views/image.php component. Unsanitized user-controlled input is passed directly to the PHP exec function, allowing remote...

CVE-2016-10204_Webshell

CVE-2016-10204Webshell A bash script demonstrating the manual exploitation of CVE-2016-10204 against a target endpoint, leading to upload of a php webshell. Currently, the webshell variable is set for a MySQL payload. This can be replaced with whatever backend you need to target. More information...

CVE-2016-10140-Zoneminder-Poc

ZoneMinder Unauthorized Access CVE-2016-10140 Poc -- Batch Verification Script Vulnerability Description ZoneMinder is an open-source video surveillance system. When abnormal events occur, you can receive email or SMS notifications. There is an information disclosure and authentication bypass...

CVE-2023-26039

CVE-2023-26039 Description ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl in /web/api/app/Controller/HostController.php. A...