17 results · Clear filters · Feed
-
High 8.5
Prototype pollution leading to stored XSS
Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype cha…
-
High 7.3
Stored XSS vulnerability in the Item history/Plain text widget
The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized actions depending on which user opens a dashboard containing the…
-
High 7.3
Stored XSS vulnerability in Host navigator widget maintenance tooltip
An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unauthorized …
-
High 8.7CVE-2026-23921 Public exploit
Blind, read-only SQL injection in Zabbix API via sortfield parameter
A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can …
-
High 7.7
Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject …
-
High 7.1
Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server
For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not…
-
High 7.5
Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host
A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.
-
High 7.3
Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0.
Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this allows for remote code execution.
-
High 7.5
Reflected XSS vulnerability in /zabbix.php?action=export.valuemaps
The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScrip…
-
High 8.6CVE-2024-36465 EPSS 40%
SQL injection in Zabbix API
A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter.
-
High 8.8
Unauthenticated Zabbix frontend takeover when SSO is being used
A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions.
-
High 7.5
Authentication privilege escalation via user groups due to missing authorization checks
An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group (e.g.: Zabbix Administrators), except to groups that are disabl…
-
High 7.5
Allocation of resources without limits or throttling (uncontrolled resource consumption)
Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandwidth, without proper limitations or controls. This can cause a denial-of-service (DoS) attack or deg…
-
High 8.1
Front-end audit log shows passwords in plaintext
The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text.
-
High 8.5
Inefficient permission check in class CControllerAuthenticationUpdate
Request to LDAP is sent before user permissions are checked.
-
High 7.6
Stored XSS in Maps element
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.
-
High 8.5
Unauthorized limited filesystem access from preprocessing
JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data.