Zabbix vulnerabilities
145 vulnerabilities
Known vulnerabilities in Zabbix products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 10 products.
Products
10- Zabbix136 vulnerabilities
- Frontend19 vulnerabilities
- Zabbix Agent24 vulnerabilities
- Zabbix Server3 vulnerabilities
- Proxy, Server1 vulnerabilities
- Web Service Report Generation1 vulnerabilities
- Zabbix Agent 2 (MSI Packages)1 vulnerabilities
- Zabbix Agent (MSI Packages)1 vulnerabilities
- Zabbix Agentd1 vulnerabilities
- Zabbix Agent1 vulnerabilities
CVE-2013-1364debianzabbix+1
EPSS score2.17%
The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter.CVE-2013-7484debianzabbix+2EPSS score1.09%
Zabbix before 5.0 represents passwords in the users table with unsalted MD5.CVE-2013-5743debianzabbix+2EPSS score79.99%
Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7.CVE-2013-5572debianzabbix+1EPSS score4.11%
Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.CVE-2013-6824debianzabbix+2EPSS score2.75%
Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user parameter.CVE-2013-3738debianzabbix+1EPSS score3.13%
A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequate sanitization of request strings in CGI scripts, which could let a remote malicious user execute arbitrary code.CVE-2013-3628zabbixzabbixEPSS score67.46%
Zabbix 2.0.9 has an Arbitrary Command Execution VulnerabilityCVE-2021-27927debianzabbix+2EPSS score2.20%
In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.CVE-2021-46088ubuntuzabbix+1EPSS score3.93%
Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user.CVE-2007-0640debianzabbix+1EPSS score2.04%
Buffer overflow in ZABBIX before 1.1.5 has unknown impact and attack vectors related to "SNMP IP addresses."CVE-2007-6210debianzabbix+1EPSS score0.78%
zabbix_agentd 1.1.4 in ZABBIX before 1.4.3 runs "UserParameter" scripts with gid 0, which might allow local users to gain privileges.CVE-2016-4338debianzabbix+2EPSS score21.14%
The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell other than bash, allows context-dependent attackers to execute arbitrary code or SQL commands via the mysql.size parameter.CVE-2016-10742debianzabbix+3EPSS score2.86%
Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request parameter.CVE-2016-10134alpinezabbix+3EPSS score83.41%
SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.CVE-2025-27231debianzabbix+2EPSS score0.46%
The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change.CVE-2025-27233debianzabbix+2EPSS score0.17%
Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.CVE-2025-27234debianzabbix+2EPSS score0.31%
Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this allows for remote code execution.CVE-2025-27236debianzabbix+2EPSS score0.37%
A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to.CVE-2025-27232ubuntuzabbix+2EPSS score0.29%
An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss.CVE-2025-27238debianzabbix+2EPSS score0.19%
Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.