Skip to content
OpenAdvisories

Package · PyPI

motioneye

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-46488

    motionEye: Authentication possible via password hash

    motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meye_username and meye_password_hash cookies as authenticati…

    motioneye-project motioneye motioneye PyPI
  • Critical —
    GHSA-phv5-334h-mxcw

    motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal

    # Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal ### Summary Myself and others have reported several RCE vulnerabilities to this project. However, due to the nature of the app, these are largely not of all that much v…

    motioneye PyPI
  • Critical 9.8
    GHSA-qxvg-h7q2-hcxh

    motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)

    ## Summary A multi‑stage chain in motionEye leads to remote code execution. The chain combines: 1. **Arbitrary file read (LFI)** via the picture download endpoint for **local motion cameras** using absolute paths. 2. **Pass‑the‑hash admin auth** due to accept…

    motioneye PyPI