Zabbix
by Zabbix
Source repositories
CVEs (128)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-45699 | Med | 0.35 | 5.4 | 0.00 | Apr 2, 2025 | The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be… | ||
| CVE-2023-29455 | Med | 0.35 | 5.4 | 0.01 | Jul 13, 2023 | Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of… | ||
| CVE-2023-29454 | Med | 0.35 | 5.4 | 0.01 | Jul 13, 2023 | Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the… | ||
| CVE-2022-43515 | Med | 0.35 | 5.3 | 0.01 | Dec 5, 2022 | Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive data will be… | ||
| CVE-2019-15132 | Med | 0.35 | 5.3 | 0.02 | Aug 17, 2019 | Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just… | ||
| CVE-2026-23931 | Med | 0.34 | — | 0.00 | Aug 18, 2026 | The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality. | ||
| CVE-2026-23923 | Med | 0.34 | 5.3 | 0.00 | Mar 24, 2026 | An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time. | ||
| CVE-2026-23922 | Med | 0.32 | 4.9 | 0.00 | Aug 18, 2026 | The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint. | ||
| CVE-2026-23924 | Med | 0.32 | 4.9 | 0.00 | Mar 24, 2026 | Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files from running Docker containers by injecting them via the Docker archive API. | ||
| CVE-2025-27232 | Med | 0.32 | 4.9 | 0.00 | Dec 1, 2025 | An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss. | ||
| CVE-2025-27231 | Med | 0.32 | 4.9 | 0.00 | Oct 3, 2025 | The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change. | ||
| CVE-2023-29451 | Med | 0.31 | 4.7 | 0.01 | Jul 13, 2023 | Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy. | ||
| CVE-2022-40626 | Med | 0.31 | 4.8 | 0.01 | Sep 14, 2022 | An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend. | ||
| CVE-2023-32728 | Med | 0.30 | 4.6 | 0.01 | Dec 18, 2023 | The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution. | ||
| CVE-2022-24349 | Med | 0.30 | 4.6 | 0.01 | Mar 9, 2022 | An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to… | ||
| CVE-2024-42326 | Med | 0.29 | 4.4 | 0.00 | Nov 27, 2024 | There was discovered a use after free bug in browser.c in the es_browser_get_variant function | ||
| CVE-2025-49641 | Med | 0.28 | 4.3 | 0.00 | Oct 3, 2025 | A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems. | ||
| CVE-2024-22114 | Med | 0.28 | 4.3 | 0.01 | Aug 12, 2024 | User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard. | ||
| CVE-2023-32726 | Low | 0.25 | 3.9 | 0.01 | Dec 18, 2023 | The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server. | ||
| CVE-2026-1199 | Low | 0.24 | 3.7 | 0.00 | Aug 18, 2026 | Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended. |
- risk 0.35cvss 5.4epss 0.00
The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be…
- risk 0.35cvss 5.4epss 0.01
Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of…
- risk 0.35cvss 5.4epss 0.01
Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the…
- risk 0.35cvss 5.3epss 0.01
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive data will be…
- risk 0.35cvss 5.3epss 0.02
Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just…
- risk 0.34cvss —epss 0.00
The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality.
- risk 0.34cvss 5.3epss 0.00
An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.
- risk 0.32cvss 4.9epss 0.00
The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint.
- risk 0.32cvss 4.9epss 0.00
Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files from running Docker containers by injecting them via the Docker archive API.
- risk 0.32cvss 4.9epss 0.00
An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss.
- risk 0.32cvss 4.9epss 0.00
The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change.
- risk 0.31cvss 4.7epss 0.01
Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.
- risk 0.31cvss 4.8epss 0.01
An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend.
- risk 0.30cvss 4.6epss 0.01
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.
- risk 0.30cvss 4.6epss 0.01
An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to…
- risk 0.29cvss 4.4epss 0.00
There was discovered a use after free bug in browser.c in the es_browser_get_variant function
- risk 0.28cvss 4.3epss 0.00
A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
- risk 0.28cvss 4.3epss 0.01
User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard.
- risk 0.25cvss 3.9epss 0.01
The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server.
- risk 0.24cvss 3.7epss 0.00
Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended.
Page 4 of 7