ZA
Monitoring
Zabbix
On CISA KEVExploited in the wild
129
CVEs
2
On KEV
9.9
Max CVSS
6
New 30D
Severity mix
Critical 13High 33Medium 43Low 13
Watch
Add Zabbix to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-59783 | 2.3 | Oct 5 | Server DoS via binary items Affected: 7.0.0 through 7.0.28; 7.4.0 through 7.4.12 |
| CVE-2024-22117 | 2.2 | Nov 26 | Value of sysmap_element_url can be de-synchronized causing the map element to crash when new URLs is added Affected: 5,0,0 through 5.0.43; 6.0.0 through 6.0.33; 6.4.0 through 6.4.18; 7.0.0 through 7.0.3 |
| CVE-2014-9450 | – | Jan 2 | Multiple SQL injection vulnerabilities in chart_bar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute… Affected: through 1.8.21; 2.0.1; 2.0.1; 2.0.1; 2.0.2; 2.0.2; +34 more |
| CVE-2014-1685 | – | May 8 | The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via… Affected: through 1.8.19; 1.8; 1.8.1; 1.8.2; 1.8.3; 1.8.3; +34 more |
| CVE-2014-1682 | – | May 8 | The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login… Affected: through 1.8.19; 1.8; 1.8.1; 1.8.2; 1.8.3; 1.8.3; +34 more |
| CVE-2012-6086 | – | Jan 29 | libs/zbxmedia/eztexting.c in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.8rc1, and 2.1.x before 2.1.2 does not properly set the CURLOPT_SSL_VERIFYHOST option for libcurl,… Affected: 1.8.1; 1.8.10; 1.8.10; 1.8.15; 1.8.16; 2.0.0; +16 more |
| CVE-2013-6824 | – | Dec 19 | Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user… Affected: through 1.8.18; 2.0.0; 2.2.0 |
| CVE-2013-1364 | – | Dec 14 | The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter Affected: through 1.8.15; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4 |
| CVE-2013-5572 | – | Oct 1 | Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML… Affected: 2.0.5 |
| CVE-2012-3435 | – | Aug 15 | SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, allows remote attackers to execute arbitrary SQL commands… Affected: through 1.8.15; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2011-5027 | – | Dec 29 | Cross-site scripting (XSS) vulnerability in ZABBIX before 1.8.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the profiler Affected: through 1.8.10; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2011-4615 | – | Dec 29 | Multiple cross-site scripting (XSS) vulnerabilities in Zabbix before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via the gname parameter (aka host groups… Affected: through 1.8.10; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2011-4674 | – | Dec 2 | SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows remote attackers to execute arbitrary SQL commands via the… Affected: 1.8.3; 1.8.4 |
| CVE-2010-5049 | – | Nov 23 | SQL injection vulnerability in events.php in Zabbix 1.8.1 and earlier allows remote attackers to execute arbitrary SQL commands via the nav_time parameter Affected: through 1.8.1; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2011-3265 | – | Aug 19 | popup.php in Zabbix before 1.8.7 allows remote attackers to read the contents of arbitrary database tables via a modified srctbl parameter Affected: through 1.8.6; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2011-3264 | – | Aug 19 | Zabbix before 1.8.6 allows remote attackers to obtain sensitive information via an invalid srcfld2 parameter to popup.php, which reveals the installation path in an error message Affected: through 1.8.5; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2011-3263 | – | Aug 19 | zabbix_agentd in Zabbix before 1.8.6 and 1.9.x before 1.9.4 allows context-dependent attackers to cause a denial of service (CPU consumption) by executing the vfs.file.cksum… Affected: through 1.8.5; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2011-2904 | – | Aug 19 | Cross-site scripting (XSS) vulnerability in acknow.php in Zabbix before 1.8.6 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter Affected: through 1.8.5; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2010-2790 | – | Aug 5 | Multiple cross-site scripting (XSS) vulnerabilities in the formatQuery function in frontends/php/include/classes/class.curl.php in Zabbix before 1.8.3rc1 allow remote attackers to… Affected: through 1.8.2; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2010-1277 | – | Apr 6 | SQL injection vulnerability in the user.authenticate method in the API in Zabbix 1.8 before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the user parameter… Affected: 1.8; 1.8.1 |
| CVE-2009-4502 | – | Dec 31 | The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and… Affected: through 1.6.6; 1.1.2; 1.1.3; 1.1.4; 1.1.5; 1.4.2; +3 more |
| CVE-2009-4501 | – | Dec 31 | The zbx_get_next_field function in libs/zbxcommon/str.c in Zabbix Server before 1.6.8 allows remote attackers to cause a denial of service (crash) via a request that lacks… Affected: through 1.6.7; 1.1.2; 1.1.3; 1.1.4; 1.1.5; 1.4.2; +4 more |
| CVE-2009-4500 | – | Dec 31 | The process_trap function in trapper/trapper.c in Zabbix Server before 1.6.6 allows remote attackers to cause a denial of service (crash) via a crafted request with data that… Affected: through 1.4.6; 1.1.2; 1.1.3; 1.1.4; 1.1.5; 1.4.2; +2 more |
| CVE-2009-4499 | – | Dec 31 | SQL injection vulnerability in the get_history_lastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote attackers to execute arbitrary SQL commands… Affected: through 1.6.7; 1.1.2; 1.1.3; 1.1.4; 1.1.5; 1.4.2; +4 more |
| CVE-2009-4498 | – | Dec 31 | The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request Affected: through 1.7.4; 1.1.2; 1.1.3; 1.1.4; 1.1.5; 1.4.2; +8 more |
| CVE-2008-1353 | – | Mar 17 | zabbix_agentd in ZABBIX 1.4.4 allows remote attackers to cause a denial of service (CPU and connection consumption) via multiple vfs.file.cksum commands with a special device node… Affected: 1.1.2; 1.1.3; 1.1.4; 1.1.5; 1.4.2; 1.4.3 |
| CVE-2007-0640 | – | Jan 31 | Buffer overflow in ZABBIX before 1.1.5 has unknown impact and attack vectors related to "SNMP IP addresses." Affected: through 1.1.4; 1.1.2; 1.1.3 |
| CVE-2006-6693 | – | Dec 21 | Multiple buffer overflows in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via long strings to the… Affected: 1.1.2 |
| CVE-2006-6692 | – | Dec 21 | Multiple format string vulnerabilities in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format… Affected: 1.1.2 |