https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-27470.htmlhttps://patchthecve.com/cve/CVE-2026-27470.htmlWed, 17 Jun 2026 10:27:12 +0000HIGH 8.8: ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function. Event field values (specifically Name ahttps://patchthecve.com/cve/CVE-2025-65791.htmlhttps://patchthecve.com/cve/CVE-2025-65791.htmlWed, 17 Jun 2026 09:55:55 +0000CRITICAL 9.8: ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. NOTE: this is disputed by the Supplier because there is no unsanitized user input to web/views/image.php.https://patchthecve.com/cve/CVE-2023-31493.htmlhttps://patchthecve.com/cve/CVE-2023-31493.htmlSun, 05 Jul 2026 01:18:30 +0000MEDIUM 6.6: RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted payload and escalate privileges allowing execution of any commands on the remote system.https://patchthecve.com/cve/CVE-2024-43360.htmlhttps://patchthecve.com/cve/CVE-2024-43360.htmlWed, 17 Jun 2026 07:50:53 +0000CRITICAL 9.8: ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.https://patchthecve.com/cve/CVE-2024-43359.htmlhttps://patchthecve.com/cve/CVE-2024-43359.htmlWed, 17 Jun 2026 07:50:52 +0000NONE 0.0: ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the montagereview via the displayinterval, speed, and scale parameters. This vulnerability is fixed in 1.36.34 and 1.37.61.https://patchthecve.com/cve/CVE-2024-43358.htmlhttps://patchthecve.com/cve/CVE-2024-43358.htmlWed, 17 Jun 2026 07:50:52 +0000MEDIUM 6.1: ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the filter view via the filter[Id]. This vulnerability is fixed in 1.36.34 and 1.37.61.https://patchthecve.com/cve/CVE-2023-41884.htmlhttps://patchthecve.com/cve/CVE-2023-41884.htmlWed, 17 Jun 2026 06:23:00 +0000HIGH 7.1: ZoneMinder is a free, open source Closed-circuit television software application. In WWW/AJAX/watch.php, Line: 51 takes a few parameter in sql query without sanitizing it which makes it vulnerable to sql injection. This vulnerability is fixed in 1.36.34.https://patchthecve.com/cve/CVE-2020-25730.htmlhttps://patchthecve.com/cve/CVE-2020-25730.htmlWed, 17 Jun 2026 03:07:12 +0000HIGH 8.2: Cross Site Scripting (XSS) vulnerability in ZoneMinder before version 1.34.21, allows remote attackers execute arbitrary code, escalate privileges, and obtain sensitive information via PHP_SELF component in classic/views/download.php.