Unrated severityNVD Advisory· Published Feb 26, 2010· Updated Apr 29, 2026

CVE-2010-0712

Description

Multiple SQL injection vulnerabilities in zport/dmd/Events/getJSONEventsInfo in Zenoss 2.3.3, and other versions before 2.5, allow remote authenticated users to execute arbitrary SQL commands via the (1) severity, (2) state, (3) filter, (4) offset, and (5) count parameters.

Affected products

Zenoss/Zenoss5 versions
cpe:2.3:a:zenoss:zenoss:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:zenoss:zenoss:*:*:*:*:*:*:*:*range: <=2.4.5
- cpe:2.3:a:zenoss:zenoss:2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:zenoss:zenoss:2.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:zenoss:zenoss:2.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:zenoss:zenoss:2.4.2:*:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.securityfocus.com/bid/37802nvdExploit
dev.zenoss.org/trac/changeset/15257nvdVendor Advisory
secunia.com/advisories/38195nvdVendor Advisory
www.zenoss.com/news/SQL-Injection-and-Cross-Site-Forgery-in-Zenoss-Core-Corrected.htmlnvdVendor Advisory
osvdb.org/61804nvd
www.ngenuity.org/wordpress/2010/01/14/ngenuity-2010-001-zenoss-getjsoneventsinfo-sql-injection/nvd
exchange.xforce.ibmcloud.com/vulnerabilities/55670nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000