High severity8.8NVD Advisory· Published Feb 21, 2026· Updated Jun 17, 2026
CVE-2026-27470
CVE-2026-27470
Description
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function. Event field values (specifically Name and Cause) are stored safely via parameterized queries but are later retrieved and concatenated directly into SQL WHERE clauses without escaping. An authenticated user with Events edit and view permissions can exploit this to execute arbitrary SQL queries.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*range: <1.36.38
- (no CPE)range: <=1.36.37, 1.37.61-1.38.0
- (no CPE)range: < 1.36.38
Patches
Vulnerability mechanics
References
4- github.com/ZoneMinder/zoneminder/security/advisories/GHSA-r6gm-478g-f2c4nvdExploitMitigationVendor Advisory
- github.com/ZoneMinder/zoneminder/releases/tag/1.36.38nvdProductRelease Notes
- github.com/ZoneMinder/zoneminder/releases/tag/1.38.1nvdProductRelease Notes
- owasp.org/www-community/attacks/SQL_InjectionnvdNot Applicable
News mentions
0No linked articles in our index yet.