What’s Vulnerable › Vulnerabilities

CVE-2024-43360: ZoneMinder Time-based SQL Injection

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-08-12 · updated 2026-06-17
• Weakness: CWE-89

Description

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.

Affected products

• zoneminder: before 1.36.34; from 1.37.00 before 1.37.61 — fixed in 1.36.34, 1.37.61

How to fix

Upgrade to a fixed version: zoneminder 1.36.34, 1.37.61. Check the vendor advisory for mitigations.

References

• https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a
• https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6
• https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397
• https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5
• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj

Get alerted when CVE-2024-43360 or the next vulnerability affects your stack