PT-2026-21370 · Unknown · Zoneminder

Acorzo1983 · Published 2026-01-01 · Updated 2026-02-21 · CVE-2026-27470

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZoneMinder versions 1.36.37 and below ZoneMinder versions 1.37.61 through 1.38.0

Description ZoneMinder is a free, open source closed-circuit television software application. A second-order SQL Injection issue exists in the web/ajax/status.php file within the getNearEvents() function. Event field values, specifically Name and Cause, are initially stored securely using parameterized queries. However, these values are later retrieved and directly concatenated into SQL WHERE clauses without proper escaping, allowing for potential exploitation. An authenticated user with Events edit and view permissions can leverage this to execute arbitrary SQL queries.

Recommendations ZoneMinder versions 1.36.37 and below: At the moment, there is no information about a newer version that contains a fix for this vulnerability. ZoneMinder versions 1.37.61 through 1.38.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-27470

GHSA-R6GM-478G-F2C4

Affected Products

Zoneminder

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27470.json · Exploit
• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-r6gm-478g-f2c4 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27470 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27470 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27470 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27470 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27470 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27470 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27470 · Security Note
• https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.1 · Note
• https://github.com/ZoneMinder/zoneminder/releases/tag/1.36.38 · Note
• https://owasp.org/www-community/attacks/SQL_Injection · Note
• https://twitter.com/CveTodo/status/2025125484351132080 · Twitter Post
• https://t.me/CVEtracker/45366 · Telegram Post
• https://twitter.com/CVEnew/status/2025154169913373140 · Twitter Post