CVE-2024-43360criticalobserved exploitationCWE-89

CVE-2024-43360: critical vulnerability in zoneminder

ZoneMinder Time-based SQL Injection

Published · Updated

Follow this CVE+ Monitor zoneminder+ Monitor zoneminder

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

65Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.8epss 6.2%
from disclosure to weapon
Published on NVDAug 12
VulnCheck+300d
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
ZoneMinder · zoneminder
Related CVEs — zoneminder

In the same product, most dangerous first.

CVE-2023-26035HIGHZoneMinder vulnerable to Missing AuthorizationEPSS 80.5%CVE-2024-51482CRITICALBoolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64EPSS 36.6%CVE-2022-39290HIGHCSRF key bypass using HTTP methods in zoneminderEPSS 7.9%CVE-2022-39291MEDIUMDenial of service through logs in zoneminderEPSS 7.1%CVE-2022-39285HIGHStored Cross-Site Scripting Vulnerability In File Parameter in zoneminderEPSS 5.1%CVE-2023-26034CRITICALZoneMinder SQL InjectionEPSS 1.6%