CVE-2025-60787

motionEye versions 0.43.1b4 and earlier are vulnerable to OS Command Injection due to a lack of server-side sanitization for the image_file_name configuration parameter. While the web UI performs client-side validation, an attacker can bypass this to inject arbitrary shell commands using subshell...

CVE-2022-25568

Summary of CVE-2022-25568 (MotionEye) : MotionEye versions 0.42.1 and earlier allow unauthenticated attackers to retrieve sensitive configuration data via a GET to /config/list when a regular user password is not configured. The risk arises from insufficient access controls on the /config/list en...

CVE-2021-44255

MotionEye (≤ 0.42.1) and MotionEyeOS (≤ 20200606) expose an authenticated RCE via uploading a configuration backup containing a malicious Python pickle. This allows a remote attacker to execute arbitrary code on the server when the installation is reachable over the Internet with weak/absent auth...