Zabbix Frontend vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Latest Zabbix Frontend vulnerabilities

CVE-2025-49643 — Frontend DoS vulnerability due to asymmetric resource consumption (CVSS 6.5)
CVE-2025-27232 — Frontend arbitrary file read in oauth.authorize action (CVSS 4.9)
CVE-2023-32725 — Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget. (CVSS 8.8)
CVE-2023-30958 — DOM XSS in Developer mode dashboard via redirect GET parameter (CVSS 6.1)
CVE-2023-29457 — Insufficient validation of Action form input fields (CVSS 6.1)
CVE-2023-29456 — Inefficient URL schema validation (CVSS 5.4)
CVE-2023-29455 — Reflected XSS in several fields of graph form (CVSS 6.1)
CVE-2023-29454 — Persistent XSS in the user form (CVSS 5.4)
CVE-2022-43515 — X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance mode (CVSS 9.8)
CVE-2022-24919 — Reflected XSS in graph configuration window of Zabbix Frontend (CVSS 4.4)
CVE-2022-24918 — Reflected XSS in item configuration window of Zabbix Frontend (CVSS 4.4)
CVE-2022-24917 — Reflected XSS in service configuration window of Zabbix Frontend (CVSS 4.4)
CVE-2022-24349 — Reflected XSS in action configuration window of Zabbix Frontend (CVSS 4.4)