Zabbix
by Zabbix
Source repositories
CVEs (121)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-29454 | Med | 0.35 | 5.4 | 0.01 | Jul 13, 2023 | Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the… | ||
| CVE-2022-43515 | Med | 0.35 | 5.3 | 0.01 | Dec 5, 2022 | Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive data will be… | ||
| CVE-2019-15132 | Med | 0.35 | 5.3 | 0.02 | Aug 17, 2019 | Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just… | ||
| CVE-2025-27232 | Med | 0.32 | 4.9 | 0.00 | Dec 1, 2025 | An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss. | ||
| CVE-2025-27231 | Med | 0.32 | 4.9 | 0.00 | Oct 3, 2025 | The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change. | ||
| CVE-2023-29451 | Med | 0.31 | 4.7 | 0.01 | Jul 13, 2023 | Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy. | ||
| CVE-2022-40626 | Med | 0.31 | 4.8 | 0.01 | Sep 14, 2022 | An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend. | ||
| CVE-2023-32728 | Med | 0.30 | 4.6 | 0.01 | Dec 18, 2023 | The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution. | ||
| CVE-2022-24349 | Med | 0.30 | 4.6 | 0.01 | Mar 9, 2022 | An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to… | ||
| CVE-2024-42326 | Med | 0.29 | 4.4 | 0.00 | Nov 27, 2024 | There was discovered a use after free bug in browser.c in the es_browser_get_variant function | ||
| CVE-2025-49641 | Med | 0.28 | 4.3 | 0.00 | Oct 3, 2025 | A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems. | ||
| CVE-2024-22114 | Med | 0.28 | 4.3 | 0.01 | Aug 12, 2024 | User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard. | ||
| CVE-2023-32726 | Low | 0.25 | 3.9 | 0.01 | Dec 18, 2023 | The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server. | ||
| CVE-2024-42332 | Low | 0.24 | 3.7 | 0.01 | Nov 27, 2024 | The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth… | ||
| CVE-2022-35230 | Low | 0.24 | 3.7 | 0.01 | Jul 6, 2022 | An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. | ||
| CVE-2022-35229 | Low | 0.24 | 3.7 | 0.01 | Jul 6, 2022 | An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. | ||
| CVE-2022-24919 | Low | 0.24 | 3.7 | 0.01 | Mar 9, 2022 | An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code… | ||
| CVE-2022-24918 | Low | 0.24 | 3.7 | 0.01 | Mar 9, 2022 | An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code… | ||
| CVE-2022-24917 | Low | 0.24 | 3.7 | 0.01 | Mar 9, 2022 | An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious… | ||
| CVE-2017-2826 | Low | 0.24 | 3.7 | 0.03 | Apr 9, 2018 | An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X. A specially crafted iConfig proxy request can cause the Zabbix server to send the configuration information of any Zabbix proxy, resulting in information disclosure. An attacker… |
- risk 0.35cvss 5.4epss 0.01
Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the…
- risk 0.35cvss 5.3epss 0.01
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive data will be…
- risk 0.35cvss 5.3epss 0.02
Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just…
- risk 0.32cvss 4.9epss 0.00
An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss.
- risk 0.32cvss 4.9epss 0.00
The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change.
- risk 0.31cvss 4.7epss 0.01
Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.
- risk 0.31cvss 4.8epss 0.01
An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend.
- risk 0.30cvss 4.6epss 0.01
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.
- risk 0.30cvss 4.6epss 0.01
An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to…
- risk 0.29cvss 4.4epss 0.00
There was discovered a use after free bug in browser.c in the es_browser_get_variant function
- risk 0.28cvss 4.3epss 0.00
A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
- risk 0.28cvss 4.3epss 0.01
User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard.
- risk 0.25cvss 3.9epss 0.01
The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server.
- risk 0.24cvss 3.7epss 0.01
The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth…
- risk 0.24cvss 3.7epss 0.01
An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
- risk 0.24cvss 3.7epss 0.01
An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
- risk 0.24cvss 3.7epss 0.01
An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code…
- risk 0.24cvss 3.7epss 0.01
An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code…
- risk 0.24cvss 3.7epss 0.01
An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious…
- risk 0.24cvss 3.7epss 0.03
An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X. A specially crafted iConfig proxy request can cause the Zabbix server to send the configuration information of any Zabbix proxy, resulting in information disclosure. An attacker…
Page 4 of 7