CVE-2026-27470

Katalog CVE

CVSS 8.8 · High EPSS 0,57%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada zoneminder. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function. Event field values (specifically Name and Cause) are stored safely via parameterized queries but are later retrieved and concatenated directly into SQL WHERE clauses without escaping. An authenticated user with Events edit and view permissions can exploit this to execute arbitrary SQL queries.

Rincian

Terbit di NVD

21 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-r6gm-478g-f2c4 exploit · mitigasi · advisory vendor
• https://github.com/ZoneMinder/zoneminder/releases/tag/1.36.38 product · release notes
• https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.1 product · release notes
• https://owasp.org/www-community/attacks/SQL_Injection not applicable