Zabbix

8 results · Clear filters · Feed

• High 8.7
  CVE-2026-23921 Public exploit

  Blind, read-only SQL injection in Zabbix API via sortfield parameter

  A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can …

  Zabbix Zabbix zabbix zabbix Debian Ubuntu
  Mar 24, 2026
• High 7.3
  CVE-2025-27237 Public exploit

  DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration

  In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification and potential local privilege escalation by injecting a DLL.

  Zabbix Zabbix
  Oct 3, 2025
• Critical 9.9
  CVE-2024-42327 Public exploit EPSS 79%

  SQL injection in user.get API

  A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from th…

  Zabbix Zabbix zabbix zabbix Debian Ubuntu Alpine
  Nov 27, 2024
• Critical 9.1
  CVE-2024-22120 Public exploit EPSS 77%

  Time Based SQL Injection in Zabbix Server Audit Log

  Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL inje…

  Zabbix Zabbix zabbix zabbix Debian Ubuntu Alpine
  May 17, 2024
• Low 3.7
  CVE-2022-23134 Exploited Public exploit Scanner template EPSS 95%

  Possible view of the setup pages by unauthenticated users if config file already exists

  After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

  Zabbix Frontend zabbix Debian
  Jan 13, 2022

  KEV Feb 22, 2022
• Critical 9.1
  CVE-2022-23131 Exploited Public exploit Scanner template EPSS 96%

  Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML

  In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to esca…

  Zabbix Frontend
  Jan 13, 2022

  KEV Feb 22, 2022
• Unscored —
  CVE-2013-3628 Public exploit EPSS 67%

  Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability

  Zabbix Zabbix
  Feb 7, 2020
• Unscored —
  CVE-2017-2824 Public exploit EPSS 26%

  An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A speci…

  Zabbix Zabbix Server zabbix zabbix Debian Ubuntu
  May 24, 2017