Zabbix
Monthly
Session cookie forgery in Zabbix 7.4 is possible because the cryptographic key used to sign Frontend sessions is erroneously written to the database seed, making it readable by anyone with adjacent database access. The vendor-confirmed exploitation path is narrowly scoped: only deployments running both SAML authentication and guest users simultaneously are at known risk, where the extracted key can be used to forge valid session cookies and achieve unauthorized frontend access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the vendor explicitly states no known impact for deployments outside the SAML-plus-guest-user configuration.
Persistent XSS in Zabbix Maps is triggered by prototype pollution in the searchParamsToObject() function, which processes URL query parameters without filtering reserved JavaScript properties such as __proto__. An authenticated low-privilege attacker can craft a malicious URL that pollutes Object.prototype; when a victim user views the Maps page, jQuery's unsafe DOM element creation traverses the poisoned prototype chain and executes the attacker-controlled payload in the victim's browser session. No public exploit code and no CISA KEV entry have been identified at time of analysis, but the vulnerability class is well-understood and reproducible by intermediate-level attackers.
Stored cross-site scripting (XSS) in Zabbix 6.0-7.4 allows authenticated attackers with high privileges to inject malicious JavaScript via monitored host data that executes when other users view dashboards containing Item history widgets (7.0+) or Plain text widgets (6.0). The attack requires the attacker to control a monitored host and the victim to open a dashboard with HTML display enabled in the affected widget. CVSS 7.3 reflects high impact but requires specific preconditions: high-privilege access (PR:H), user interaction (UI:P), and precise attack timing (AT:P). No CISA KEV listing or public exploit identified at time of analysis, with low immediate exploitation risk given the privilege requirements.
Stored Cross-Site Scripting (XSS) in Zabbix 7.0.x and 7.4.x allows authenticated administrators with non-super privileges to inject JavaScript payloads into maintenance period configurations. The malicious code executes when any user, including super admins, hovers over the affected maintenance period in the Host navigator widget tooltip, enabling session hijacking, credential theft, or unauthorized administrative actions with the victim's elevated privileges. Attack complexity is low and requires only user interaction (hovering), though exploit execution depends on victim access patterns. No public exploit code or active exploitation confirmed at time of analysis.
A blind SQL injection vulnerability exists in Zabbix's API service layer (include/classes/api/CApiService.php) via the sortfield parameter that allows low-privilege users with API access to execute arbitrary SQL SELECT queries without direct result exfiltration. An attacker can leverage time-based blind SQL injection techniques to extract sensitive data such as session identifiers and administrator credentials, potentially leading to full administrative compromise of the Zabbix monitoring infrastructure. No CVSS score, EPSS data, or KEV status has been published, but the vulnerability's reliance on blind techniques and low-privilege requirement suggests moderate real-world exploitability.
Authenticated users can bypass regex-based input validation in command injection action scripts by injecting newline characters that exploit multiline mode anchors, allowing shell command execution. This vulnerability affects systems using administrator-configured validation patterns with ^ and $ anchors, enabling authenticated attackers to achieve arbitrary command execution. No patch is currently available.
Zabbix Server and Proxy reuse JavaScript (Duktape) execution contexts across script items, JavaScript preprocessing, and webhooks for performance optimization, allowing non-super administrators to leak sensitive data about hosts they lack authorization to access through context variable persistence. The vulnerability enables information disclosure attacks where a regular administrator can access confidential monitoring data from restricted hosts by exploiting shared JavaScript execution environments. A patch has been released that makes built-in Zabbix JavaScript objects read-only, though global variable usage remains unsafe even after remediation.
Stored cross-site scripting in Zabbix lets a crafted email media type configuration run arbitrary JavaScript in the browser of the Super Admin who approves it: the media type's OAuth form passes the attacker-controlled 'Authorization endpoint' value directly to window.open() without validating the URL scheme, so a javascript: URL executes in the frontend's origin. Exploitation is authenticated and interaction-dependent - the payload must first be delivered as an import file by a user with high frontend privileges (PR:H), and a Super Admin must then open that media type's OAuth form and actively click to grant consent (UI:A / UI:R) - which is consistent with the published CVSS 4.0 base score of 5.6 and our assessed CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N. No public exploit code and no confirmed active exploitation were identified at time of analysis, so although the flaw is genuine and script execution occurs in a highly privileged session, it is a constrained medium-severity issue rather than a mass-exploitation priority.
SNMP trap injection against Zabbix's bundled Perl trap receiver script allows a party that can deliver traps accepted by that receiver to forge a record against a different host, corrupting the integrity of collected monitoring data with no confidentiality or availability impact. The root cause is a failure to neutralize the ZBXTRAP record delimiter in CWE-143 terms, and only deployments that ingest traps through the shipped Perl script (typically wired into snmptrapd) are exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the independent assessment rates this as a moderate, low-priority integrity issue (CVSS 3.1 5.3) rather than an urgent threat.
Zabbix Server and Zabbix Proxy accept the active-agent heartbeat message without validating the configured PSK or TLS certificate, so anyone who can reach the trapper port (default TCP 10051) and knows or guesses a valid host identifier can report an arbitrary host running an active agent as available. The resulting impact is integrity-only - falsified host availability state - with no data exposure, no code execution and no denial of service; our independent assessment (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) matches the vendor's CVSS 4.0 base score of 6.9 in treating this as a moderate, non-emergency issue. No public exploit code or confirmed active exploitation was identified at time of analysis.
The Host search feature in the Zabbix Frontend allows filtering on fields that are never displayed in search results, including stored IPMI credentials and PSK values, so an authenticated user with read access to hosts can submit a guessed secret and infer from whether results are returned whether the guess was correct. This is a guess-confirmation oracle rather than a direct credential readout: each request leaks only one bit of information, so short or weak IPMI passwords are realistically recoverable through repeated queries, while high-entropy PSK secrets may be impractical to brute-force. Successful abuse yields low-confidentiality impact and requires the attacker to already hold a valid low-privileged frontend account (PR:L, authenticated per the CVSS vectors); no public exploit code or confirmed active exploitation has been identified at time of analysis.
Zabbix Server and Proxy can be crashed by a crafted binary item value containing a NULL byte, causing loss of monitoring availability on deployments that use MySQL or MariaDB as the Zabbix backend database. Exploitation is not anonymous: the CVSS vector (PR:L) indicates an authenticated, low-privileged user able to submit binary item values is required, and the attack additionally depends on a specific input condition (AT:P), which is why the vendor-assigned severity is low (CVSS 4.0 base 2.3) and our independent assessment matches at CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); impact is confined to availability, with no confirmed data exposure, integrity loss, or code execution.
Information disclosure in the Zabbix server's JavaScript preprocessing engine (embedded Duktape interpreter) allows an authenticated 'limited administrator' account to read raw heap memory and potentially expose data belonging to other concurrently running preprocessors that the account should not be able to access. The root cause is an out-of-bounds read (CWE-125) in the JavaScript preprocessing path; exploitation requires only the ability to define or run a JavaScript preprocessing step, and there is no integrity or availability impact. No public exploit code was identified at time of analysis and there is no CISA KEV entry; this is a moderate-severity privilege-boundary/tenant-isolation issue (CVSS 4.0 base 6.9; assessed CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) rather than an unauthenticated remote compromise.
DLL sideloading in the Zabbix Agent Windows installer allows a local attacker with write access to a custom installation directory to plant a malicious DLL that the agent process subsequently loads. The installer previously failed to validate whether a user-selected directory had appropriately restrictive access controls, leaving deployments in permissive directories silently exposed. No public exploit has been identified at time of analysis, and the vendor has already shipped a hardened installer that warns users before proceeding with potentially unsafe target directories.
Denial of service in Zabbix server and proxy can be triggered by an authenticated administrator who crafts malicious JavaScript scripts within preprocessing or script item configurations, causing the server or proxy process to crash. All Zabbix versions are listed as affected per the wildcard CPE entry. Exploitation requires high-privilege administrative access, and no public exploit code or CISA KEV listing exists at time of analysis.
Zabbix's API host.get action exposes PSK (Pre-Shared Key) credential material to authenticated low-privileged users, allowing extraction of secrets used to secure TLS-encrypted communications between the Zabbix server and monitored agents. Any authenticated API user can query host.get and retrieve PSK values configured on hosts, undermining the confidentiality of those credentials and the integrity of the monitoring infrastructure they protect. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds memory read in Zabbix's script item and preprocessing JavaScript HttpRequest logic allows an authenticated administrator, operating from an adjacent network position, to read process memory beyond allocated buffer boundaries. Exploitation results in confidentiality loss - sensitive data resident in process memory may be exposed to the attacker. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Zabbix Frontend's validate.api.exists action can be exploited by authenticated, adjacent-network users to trigger disproportionate CPU consumption on the webserver, resulting in potential denial of service. All Zabbix versions are indicated as affected per vendor-supplied CPE data (cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*), and the vulnerability is rooted in CWE-405 asymmetric resource amplification. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 score of 5.1 reflects the constrained blast radius imposed by the authentication and adjacent-network prerequisites.
Zabbix frontend information disclosure via the `validatate.api.exists` action permits authenticated users to extract plaintext user macro values that are otherwise masked in the standard UI. Any account with Zabbix frontend access can invoke this API action to retrieve macro contents, which frequently include embedded credentials, SNMP community strings, API tokens, or other operational secrets. No public exploit or confirmed active exploitation has been identified at time of analysis, but the practical impact exceeds what the CVSS low-confidentiality rating implies when sensitive secrets are stored in macros.
Zabbix Frontend's popup.testtriggerexpr action can be abused by unauthenticated adjacent-network attackers to cause disproportionate CPU load on the webserver, resulting in potential denial of service for monitoring operations. All Zabbix versions appear affected based on the wildcard CPE string. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.3 reflects moderate, realistic availability risk constrained to adjacent-network attackers with no confidentiality or integrity exposure.
Login lockout bypass in Zabbix API and Frontend enables brute-force attacks beyond intended limits by exploiting a race condition in the block counter. Simultaneous login requests are not properly synchronized against the lockout mechanism, allowing unauthenticated remote attackers to submit more credential guesses than the lockout policy permits. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, no-authentication-required attack surface lowers the barrier for credential-stuffing campaigns against Zabbix deployments.
OAuth client secret exposure in Zabbix email media configuration allows a Super Admin to exfiltrate the stored client secret by pointing the Token endpoint to an attacker-controlled server. Because the secret is masked in the UI after saving but still transmitted when OAuth token requests are made, changing the endpoint URL effectively redirects the credential to an external host. No public exploit or active exploitation has been identified; the vendor has addressed the issue by resetting the client secret whenever the token endpoint is changed.
Zabbix Agent 2 allows remote attackers with high privileges to inject malicious Oracle TNS connection strings via the 'service' parameter, enabling credential theft from saved database sessions. The vulnerability requires network access and high-level privileges but can lead to disclosure of Oracle database credentials if they are stored in named sessions. CVSS 5.1 reflects the requirement for authenticated attacker access (PR:H), though the impact to stored credentials is significant.
The Zabbix Agent 2 Docker plugin contains an argument injection vulnerability in the 'docker.container_info' parameter handler that fails to properly sanitize user-supplied input before forwarding requests to the Docker daemon. An authenticated attacker who can invoke Agent 2 can exploit this flaw to read arbitrary files from running Docker containers by injecting malicious parameters through the Docker archive API, potentially exposing sensitive application data, credentials, and configuration files. While no CVSS score or EPSS data is currently available, and no indication of active exploitation in the wild has been reported, this represents a direct path to container escape and lateral movement for attackers with agent-level access.
An unauthenticated remote code execution vulnerability exists in Zabbix's Frontend 'validate' action that permits blind instantiation of arbitrary PHP classes without authentication. The vulnerability affects Zabbix products across multiple versions as indicated by the CPE wildcard notation, and while the immediate impact appears limited by environment-specific constraints, successful exploitation could lead to information disclosure or arbitrary code execution depending on available PHP classes in the deployment context. No CVSS score, EPSS data, or KEV status is currently published, but the attack vector is unauthenticated and likely has low complexity, suggesting meaningful real-world risk.
An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts.
Denial of service in the Zabbix web frontend allows an authenticated user - including the built-in Guest account when Guest access is still enabled - to drive disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore.php. The vulnerable image-serving endpoint amplifies trivial requests into heavy server-side processing, so sustained requests can exhaust frontend CPU and impair availability of the Zabbix UI for legitimate operators. Affected builds span Zabbix 6.0.0-6.0.41, 7.0.0-7.0.18, 7.2.0-7.2.12 and 7.4.0-7.4.2; a vendor patch is available, EPSS is low (0.05%, 16th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary file read in Zabbix Frontend 7.4.0 through 7.4.2 allows an authenticated Super Admin to exploit the oauth.authorize action to read files from the web server, resulting in confidentiality loss. The requirement for the highest-privilege role makes this primarily an insider-abuse or post-compromise vulnerability, not an external attack vector. EPSS is very low (0.03%) and no public exploit has been identified; the vendor has released patches.
A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to.
The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change.
A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.
Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. Rated medium severity (CVSS 6.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Zabbix API user.get returns all users that share common group with the calling user. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.
Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one. Rated low severity (CVSS 2.3), this vulnerability is no authentication required. No vendor patch available.
A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter. Rated high severity (CVSS 8.6), this vulnerability is low attack complexity. No vendor patch available.
A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When exporting media types, the password is exported in the YAML in plain text. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
There was discovered a use after free bug in browser.c in the es_browser_get_variant function. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When a URL is added to the map element, it is recorded in the database with sequential IDs. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable. No vendor patch available.
Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandwidth, without proper limitations or. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Setting SMS media allows to set GSM modem file. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Zabbix allows to configure SMS notifications. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. No vendor patch available.
An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Zabbix server can perform command execution for configured scripts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory pointer is in a property of the Ducktape object. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Request to LDAP is sent before user permissions are checked. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
URL validation scheme receives input from a user and then parses it to identify its various components. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login,. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Session cookie forgery in Zabbix 7.4 is possible because the cryptographic key used to sign Frontend sessions is erroneously written to the database seed, making it readable by anyone with adjacent database access. The vendor-confirmed exploitation path is narrowly scoped: only deployments running both SAML authentication and guest users simultaneously are at known risk, where the extracted key can be used to forge valid session cookies and achieve unauthorized frontend access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the vendor explicitly states no known impact for deployments outside the SAML-plus-guest-user configuration.
Persistent XSS in Zabbix Maps is triggered by prototype pollution in the searchParamsToObject() function, which processes URL query parameters without filtering reserved JavaScript properties such as __proto__. An authenticated low-privilege attacker can craft a malicious URL that pollutes Object.prototype; when a victim user views the Maps page, jQuery's unsafe DOM element creation traverses the poisoned prototype chain and executes the attacker-controlled payload in the victim's browser session. No public exploit code and no CISA KEV entry have been identified at time of analysis, but the vulnerability class is well-understood and reproducible by intermediate-level attackers.
Stored cross-site scripting (XSS) in Zabbix 6.0-7.4 allows authenticated attackers with high privileges to inject malicious JavaScript via monitored host data that executes when other users view dashboards containing Item history widgets (7.0+) or Plain text widgets (6.0). The attack requires the attacker to control a monitored host and the victim to open a dashboard with HTML display enabled in the affected widget. CVSS 7.3 reflects high impact but requires specific preconditions: high-privilege access (PR:H), user interaction (UI:P), and precise attack timing (AT:P). No CISA KEV listing or public exploit identified at time of analysis, with low immediate exploitation risk given the privilege requirements.
Stored Cross-Site Scripting (XSS) in Zabbix 7.0.x and 7.4.x allows authenticated administrators with non-super privileges to inject JavaScript payloads into maintenance period configurations. The malicious code executes when any user, including super admins, hovers over the affected maintenance period in the Host navigator widget tooltip, enabling session hijacking, credential theft, or unauthorized administrative actions with the victim's elevated privileges. Attack complexity is low and requires only user interaction (hovering), though exploit execution depends on victim access patterns. No public exploit code or active exploitation confirmed at time of analysis.
A blind SQL injection vulnerability exists in Zabbix's API service layer (include/classes/api/CApiService.php) via the sortfield parameter that allows low-privilege users with API access to execute arbitrary SQL SELECT queries without direct result exfiltration. An attacker can leverage time-based blind SQL injection techniques to extract sensitive data such as session identifiers and administrator credentials, potentially leading to full administrative compromise of the Zabbix monitoring infrastructure. No CVSS score, EPSS data, or KEV status has been published, but the vulnerability's reliance on blind techniques and low-privilege requirement suggests moderate real-world exploitability.
Authenticated users can bypass regex-based input validation in command injection action scripts by injecting newline characters that exploit multiline mode anchors, allowing shell command execution. This vulnerability affects systems using administrator-configured validation patterns with ^ and $ anchors, enabling authenticated attackers to achieve arbitrary command execution. No patch is currently available.
Zabbix Server and Proxy reuse JavaScript (Duktape) execution contexts across script items, JavaScript preprocessing, and webhooks for performance optimization, allowing non-super administrators to leak sensitive data about hosts they lack authorization to access through context variable persistence. The vulnerability enables information disclosure attacks where a regular administrator can access confidential monitoring data from restricted hosts by exploiting shared JavaScript execution environments. A patch has been released that makes built-in Zabbix JavaScript objects read-only, though global variable usage remains unsafe even after remediation.
Stored cross-site scripting in Zabbix lets a crafted email media type configuration run arbitrary JavaScript in the browser of the Super Admin who approves it: the media type's OAuth form passes the attacker-controlled 'Authorization endpoint' value directly to window.open() without validating the URL scheme, so a javascript: URL executes in the frontend's origin. Exploitation is authenticated and interaction-dependent - the payload must first be delivered as an import file by a user with high frontend privileges (PR:H), and a Super Admin must then open that media type's OAuth form and actively click to grant consent (UI:A / UI:R) - which is consistent with the published CVSS 4.0 base score of 5.6 and our assessed CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N. No public exploit code and no confirmed active exploitation were identified at time of analysis, so although the flaw is genuine and script execution occurs in a highly privileged session, it is a constrained medium-severity issue rather than a mass-exploitation priority.
SNMP trap injection against Zabbix's bundled Perl trap receiver script allows a party that can deliver traps accepted by that receiver to forge a record against a different host, corrupting the integrity of collected monitoring data with no confidentiality or availability impact. The root cause is a failure to neutralize the ZBXTRAP record delimiter in CWE-143 terms, and only deployments that ingest traps through the shipped Perl script (typically wired into snmptrapd) are exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the independent assessment rates this as a moderate, low-priority integrity issue (CVSS 3.1 5.3) rather than an urgent threat.
Zabbix Server and Zabbix Proxy accept the active-agent heartbeat message without validating the configured PSK or TLS certificate, so anyone who can reach the trapper port (default TCP 10051) and knows or guesses a valid host identifier can report an arbitrary host running an active agent as available. The resulting impact is integrity-only - falsified host availability state - with no data exposure, no code execution and no denial of service; our independent assessment (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) matches the vendor's CVSS 4.0 base score of 6.9 in treating this as a moderate, non-emergency issue. No public exploit code or confirmed active exploitation was identified at time of analysis.
The Host search feature in the Zabbix Frontend allows filtering on fields that are never displayed in search results, including stored IPMI credentials and PSK values, so an authenticated user with read access to hosts can submit a guessed secret and infer from whether results are returned whether the guess was correct. This is a guess-confirmation oracle rather than a direct credential readout: each request leaks only one bit of information, so short or weak IPMI passwords are realistically recoverable through repeated queries, while high-entropy PSK secrets may be impractical to brute-force. Successful abuse yields low-confidentiality impact and requires the attacker to already hold a valid low-privileged frontend account (PR:L, authenticated per the CVSS vectors); no public exploit code or confirmed active exploitation has been identified at time of analysis.
Zabbix Server and Proxy can be crashed by a crafted binary item value containing a NULL byte, causing loss of monitoring availability on deployments that use MySQL or MariaDB as the Zabbix backend database. Exploitation is not anonymous: the CVSS vector (PR:L) indicates an authenticated, low-privileged user able to submit binary item values is required, and the attack additionally depends on a specific input condition (AT:P), which is why the vendor-assigned severity is low (CVSS 4.0 base 2.3) and our independent assessment matches at CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); impact is confined to availability, with no confirmed data exposure, integrity loss, or code execution.
Information disclosure in the Zabbix server's JavaScript preprocessing engine (embedded Duktape interpreter) allows an authenticated 'limited administrator' account to read raw heap memory and potentially expose data belonging to other concurrently running preprocessors that the account should not be able to access. The root cause is an out-of-bounds read (CWE-125) in the JavaScript preprocessing path; exploitation requires only the ability to define or run a JavaScript preprocessing step, and there is no integrity or availability impact. No public exploit code was identified at time of analysis and there is no CISA KEV entry; this is a moderate-severity privilege-boundary/tenant-isolation issue (CVSS 4.0 base 6.9; assessed CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) rather than an unauthenticated remote compromise.
DLL sideloading in the Zabbix Agent Windows installer allows a local attacker with write access to a custom installation directory to plant a malicious DLL that the agent process subsequently loads. The installer previously failed to validate whether a user-selected directory had appropriately restrictive access controls, leaving deployments in permissive directories silently exposed. No public exploit has been identified at time of analysis, and the vendor has already shipped a hardened installer that warns users before proceeding with potentially unsafe target directories.
Denial of service in Zabbix server and proxy can be triggered by an authenticated administrator who crafts malicious JavaScript scripts within preprocessing or script item configurations, causing the server or proxy process to crash. All Zabbix versions are listed as affected per the wildcard CPE entry. Exploitation requires high-privilege administrative access, and no public exploit code or CISA KEV listing exists at time of analysis.
Zabbix's API host.get action exposes PSK (Pre-Shared Key) credential material to authenticated low-privileged users, allowing extraction of secrets used to secure TLS-encrypted communications between the Zabbix server and monitored agents. Any authenticated API user can query host.get and retrieve PSK values configured on hosts, undermining the confidentiality of those credentials and the integrity of the monitoring infrastructure they protect. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds memory read in Zabbix's script item and preprocessing JavaScript HttpRequest logic allows an authenticated administrator, operating from an adjacent network position, to read process memory beyond allocated buffer boundaries. Exploitation results in confidentiality loss - sensitive data resident in process memory may be exposed to the attacker. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Zabbix Frontend's validate.api.exists action can be exploited by authenticated, adjacent-network users to trigger disproportionate CPU consumption on the webserver, resulting in potential denial of service. All Zabbix versions are indicated as affected per vendor-supplied CPE data (cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*), and the vulnerability is rooted in CWE-405 asymmetric resource amplification. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 score of 5.1 reflects the constrained blast radius imposed by the authentication and adjacent-network prerequisites.
Zabbix frontend information disclosure via the `validatate.api.exists` action permits authenticated users to extract plaintext user macro values that are otherwise masked in the standard UI. Any account with Zabbix frontend access can invoke this API action to retrieve macro contents, which frequently include embedded credentials, SNMP community strings, API tokens, or other operational secrets. No public exploit or confirmed active exploitation has been identified at time of analysis, but the practical impact exceeds what the CVSS low-confidentiality rating implies when sensitive secrets are stored in macros.
Zabbix Frontend's popup.testtriggerexpr action can be abused by unauthenticated adjacent-network attackers to cause disproportionate CPU load on the webserver, resulting in potential denial of service for monitoring operations. All Zabbix versions appear affected based on the wildcard CPE string. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.3 reflects moderate, realistic availability risk constrained to adjacent-network attackers with no confidentiality or integrity exposure.
Login lockout bypass in Zabbix API and Frontend enables brute-force attacks beyond intended limits by exploiting a race condition in the block counter. Simultaneous login requests are not properly synchronized against the lockout mechanism, allowing unauthenticated remote attackers to submit more credential guesses than the lockout policy permits. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, no-authentication-required attack surface lowers the barrier for credential-stuffing campaigns against Zabbix deployments.
OAuth client secret exposure in Zabbix email media configuration allows a Super Admin to exfiltrate the stored client secret by pointing the Token endpoint to an attacker-controlled server. Because the secret is masked in the UI after saving but still transmitted when OAuth token requests are made, changing the endpoint URL effectively redirects the credential to an external host. No public exploit or active exploitation has been identified; the vendor has addressed the issue by resetting the client secret whenever the token endpoint is changed.
Zabbix Agent 2 allows remote attackers with high privileges to inject malicious Oracle TNS connection strings via the 'service' parameter, enabling credential theft from saved database sessions. The vulnerability requires network access and high-level privileges but can lead to disclosure of Oracle database credentials if they are stored in named sessions. CVSS 5.1 reflects the requirement for authenticated attacker access (PR:H), though the impact to stored credentials is significant.
The Zabbix Agent 2 Docker plugin contains an argument injection vulnerability in the 'docker.container_info' parameter handler that fails to properly sanitize user-supplied input before forwarding requests to the Docker daemon. An authenticated attacker who can invoke Agent 2 can exploit this flaw to read arbitrary files from running Docker containers by injecting malicious parameters through the Docker archive API, potentially exposing sensitive application data, credentials, and configuration files. While no CVSS score or EPSS data is currently available, and no indication of active exploitation in the wild has been reported, this represents a direct path to container escape and lateral movement for attackers with agent-level access.
An unauthenticated remote code execution vulnerability exists in Zabbix's Frontend 'validate' action that permits blind instantiation of arbitrary PHP classes without authentication. The vulnerability affects Zabbix products across multiple versions as indicated by the CPE wildcard notation, and while the immediate impact appears limited by environment-specific constraints, successful exploitation could lead to information disclosure or arbitrary code execution depending on available PHP classes in the deployment context. No CVSS score, EPSS data, or KEV status is currently published, but the attack vector is unauthenticated and likely has low complexity, suggesting meaningful real-world risk.
An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts.
Denial of service in the Zabbix web frontend allows an authenticated user - including the built-in Guest account when Guest access is still enabled - to drive disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore.php. The vulnerable image-serving endpoint amplifies trivial requests into heavy server-side processing, so sustained requests can exhaust frontend CPU and impair availability of the Zabbix UI for legitimate operators. Affected builds span Zabbix 6.0.0-6.0.41, 7.0.0-7.0.18, 7.2.0-7.2.12 and 7.4.0-7.4.2; a vendor patch is available, EPSS is low (0.05%, 16th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary file read in Zabbix Frontend 7.4.0 through 7.4.2 allows an authenticated Super Admin to exploit the oauth.authorize action to read files from the web server, resulting in confidentiality loss. The requirement for the highest-privilege role makes this primarily an insider-abuse or post-compromise vulnerability, not an external attack vector. EPSS is very low (0.03%) and no public exploit has been identified; the vendor has released patches.
A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to.
The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change.
A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.
Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. Rated medium severity (CVSS 6.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Zabbix API user.get returns all users that share common group with the calling user. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.
Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one. Rated low severity (CVSS 2.3), this vulnerability is no authentication required. No vendor patch available.
A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter. Rated high severity (CVSS 8.6), this vulnerability is low attack complexity. No vendor patch available.
A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When exporting media types, the password is exported in the YAML in plain text. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
There was discovered a use after free bug in browser.c in the es_browser_get_variant function. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When a URL is added to the map element, it is recorded in the database with sequential IDs. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable. No vendor patch available.
Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandwidth, without proper limitations or. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Setting SMS media allows to set GSM modem file. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Zabbix allows to configure SMS notifications. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. No vendor patch available.
An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Zabbix server can perform command execution for configured scripts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory pointer is in a property of the Ducktape object. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Request to LDAP is sent before user permissions are checked. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
URL validation scheme receives input from a user and then parses it to identify its various components. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login,. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.