CVE-2026-27470

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function. Event field values (specifically Name and Cause) are stored safely via parameterized queries but are later retrieved and concatenated directly into SQL WHERE clauses without escaping. An authenticated user with Events edit and view permissions can exploit this to execute arbitrary SQL queries.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ZoneMinder/zoneminder/releases/tag/1.36.38	Product Release Notes
https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.1	Product Release Notes
https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-r6gm-478g-f2c4	Exploit Mitigation Vendor Advisory
https://owasp.org/www-community/attacks/SQL_Injection	Not Applicable

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zoneminder:zoneminder::::::::
	cpe:2.3:a:zoneminder:zoneminder::::::::

History

No history.

Information

Published : 2026-02-21 08:16

Updated : 2026-02-24 14:48

NVD link : CVE-2026-27470

Mitre link : CVE-2026-27470

CVE.ORG link : CVE-2026-27470

JSON object : View

Products Affected

zoneminder

zoneminder

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-27470", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2026-02-21T08:16:12.197", "references": [{"url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.36.38", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.1", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-r6gm-478g-f2c4", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://owasp.org/www-community/attacks/SQL_Injection", "tags": ["Not Applicable"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function. Event field values (specifically Name and Cause) are stored safely via parameterized queries but are later retrieved and concatenated directly into SQL WHERE clauses without escaping. An authenticated user with Events edit and view permissions can exploit this to execute arbitrary SQL queries."}, {"lang": "es", "value": "ZoneMinder es una aplicaci\u00f3n de software de televisi\u00f3n de circuito cerrado gratuita y de c\u00f3digo abierto. En las versiones 1.36.37 e inferiores y de la 1.37.61 hasta la 1.38.0, existe una vulnerabilidad de inyecci\u00f3n SQL de segundo orden en el archivo web/ajax/status.php dentro de la funci\u00f3n getNearEvents(). Los valores de los campos de evento (espec\u00edficamente Nombre y Causa) se almacenan de forma segura mediante consultas parametrizadas, pero luego se recuperan y se concatenan directamente en las cl\u00e1usulas SQL WHERE sin escapar. Un usuario autenticado con permisos de edici\u00f3n y visualizaci\u00f3n de Eventos puede explotar esto para ejecutar consultas SQL arbitrarias."}], "lastModified": "2026-02-24T14:48:36.060", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "464C2B6D-B9E6-429B-A894-099EC5A3F552", "versionEndExcluding": "1.36.38"}, {"criteria": "cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EFEBDB7E-89B6-41EB-934B-2C1F214D1A91", "versionEndExcluding": "1.38.1", "versionStartIncluding": "1.37.61"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}