Total
95 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-23133 | 2 Fedoraproject, Zabbix | 2 Fedora, Zabbix | 2025-11-03 | 3.5 LOW | 6.3 MEDIUM |
| An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts. | |||||
| CVE-2022-23132 | 2 Fedoraproject, Zabbix | 2 Fedora, Zabbix | 2025-11-03 | 7.5 HIGH | 3.3 LOW |
| During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level | |||||
| CVE-2024-45700 | 1 Zabbix | 1 Zabbix | 2025-11-03 | N/A | 6.5 MEDIUM |
| Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an excessive amount of memory and perform CPU-intensive decompression operations, ultimately leading to a service crash. | |||||
| CVE-2024-45699 | 1 Zabbix | 1 Zabbix | 2025-11-03 | N/A | 5.4 MEDIUM |
| The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser. | |||||
| CVE-2024-42325 | 1 Zabbix | 1 Zabbix | 2025-11-03 | N/A | 3.5 LOW |
| Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc. | |||||
| CVE-2024-36469 | 1 Zabbix | 1 Zabbix | 2025-11-03 | N/A | 3.1 LOW |
| Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one. | |||||
| CVE-2022-23131 | 1 Zabbix | 1 Zabbix | 2025-10-30 | 5.1 MEDIUM | 9.1 CRITICAL |
| In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default). | |||||
| CVE-2022-23134 | 3 Debian, Fedoraproject, Zabbix | 3 Debian Linux, Fedora, Zabbix | 2025-10-30 | 5.0 MEDIUM | 3.7 LOW |
| After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend. | |||||
| CVE-2024-42329 | 1 Zabbix | 1 Zabbix | 2025-10-08 | N/A | 3.3 LOW |
| The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this function can fail for various reasons without an error description and then the wd->error will be NULL and trying to read from it will result in a crash. | |||||
| CVE-2024-42328 | 1 Zabbix | 1 Zabbix | 2025-10-08 | N/A | 3.3 LOW |
| When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. If the server's response is an empty document, then wd->data in the code below will remain NULL and an attempt to read from it will result in a crash. | |||||
| CVE-2024-42327 | 1 Zabbix | 1 Zabbix | 2025-10-08 | N/A | 9.9 CRITICAL |
| A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access. | |||||
| CVE-2024-42326 | 1 Zabbix | 1 Zabbix | 2025-10-08 | N/A | 4.4 MEDIUM |
| There was discovered a use after free bug in browser.c in the es_browser_get_variant function | |||||
| CVE-2024-36468 | 1 Zabbix | 1 Zabbix | 2025-10-08 | N/A | 3.0 LOW |
| The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code. This issue occurs when copying data from session->securityEngineID to local_record.engineid without proper bounds checking. | |||||
| CVE-2024-36467 | 1 Zabbix | 1 Zabbix | 2025-10-08 | N/A | 7.5 HIGH |
| An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group (e.g.: Zabbix Administrators), except to groups that are disabled or having restricted GUI access. | |||||
| CVE-2024-22117 | 1 Zabbix | 1 Zabbix | 2025-10-08 | N/A | 2.2 LOW |
| When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding sysmapelementurlid + 1. This action prevents others from adding URLs to the map element. | |||||
| CVE-2024-36463 | 1 Zabbix | 1 Zabbix | 2025-10-08 | N/A | 6.5 MEDIUM |
| The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects. | |||||
| CVE-2024-22120 | 1 Zabbix | 1 Zabbix | 2025-10-08 | N/A | 9.1 CRITICAL |
| Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection. | |||||
| CVE-2024-36465 | 1 Zabbix | 1 Zabbix | 2025-10-08 | N/A | 8.8 HIGH |
| A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter. | |||||
| CVE-2024-36466 | 1 Zabbix | 1 Zabbix | 2025-10-08 | N/A | 8.8 HIGH |
| A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions. | |||||
| CVE-2025-49641 | 1 Zabbix | 1 Zabbix | 2025-10-08 | N/A | 4.3 MEDIUM |
| A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems. | |||||