Поиск уязвимостей
Количество 48
Количество 48
ROS-20260216-80-0020
Уязвимость zabbix-latest
ROS-20260216-80-0019
Уязвимость zabbix7.4
ROS-20260216-80-0018
Уязвимость zabbix7.2
ROS-20260216-73-0022
Уязвимость zabbix-latest
ROS-20260216-73-0021
Уязвимость zabbix7.4
ROS-20260216-73-0020
Уязвимость zabbix7.2
CVE-2026-23921
A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.
CVE-2026-23921
A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.
CVE-2026-23921
A low privilege Zabbix user with API access can exploit a blind SQL in ...
CVE-2026-23920
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
CVE-2026-23920
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
CVE-2026-23920
Host and event action script input is validated with a regex (set by t ...
ROS-20260417-80-0037
Уязвимость zabbix7.4
ROS-20260417-80-0036
Уязвимость zabbix7.2
ROS-20260417-80-0035
Уязвимость zabbix7-lts
ROS-20260417-80-0034
Уязвимость zabbix7.4
ROS-20260417-80-0033
Уязвимость zabbix7.2
ROS-20260417-80-0032
Уязвимость zabbix7-lts
GHSA-j24v-fg24-6mqq
A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.
GHSA-2h5x-h7x4-hm9h
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | ROS-20260216-80-0020 Уязвимость zabbix-latest | CVSS3: 6.5 | 0% Низкий | 9 месяцев назад |
| ROS-20260216-80-0019 Уязвимость zabbix7.4 | CVSS3: 6.5 | 0% Низкий | 9 месяцев назад |
| ROS-20260216-80-0018 Уязвимость zabbix7.2 | CVSS3: 6.5 | 0% Низкий | 9 месяцев назад |
| ROS-20260216-73-0022 Уязвимость zabbix-latest | CVSS3: 6.5 | 0% Низкий | 9 месяцев назад |
| ROS-20260216-73-0021 Уязвимость zabbix7.4 | CVSS3: 6.5 | 0% Низкий | 9 месяцев назад |
| ROS-20260216-73-0020 Уязвимость zabbix7.2 | CVSS3: 6.5 | 0% Низкий | 9 месяцев назад |
 | CVE-2026-23921 A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise. | CVSS3: 8.8 | 4% Низкий | 8 месяцев назад |
 | CVE-2026-23921 A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise. | CVSS3: 8.8 | 4% Низкий | 8 месяцев назад |
| CVE-2026-23921 A low privilege Zabbix user with API access can exploit a blind SQL in ... | CVSS3: 8.8 | 4% Низкий | 8 месяцев назад |
| CVE-2026-23920 Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands. | CVSS3: 8.8 | 0% Низкий | 8 месяцев назад |
| CVE-2026-23920 Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands. | CVSS3: 8.8 | 0% Низкий | 8 месяцев назад |
| CVE-2026-23920 Host and event action script input is validated with a regex (set by t ... | CVSS3: 8.8 | 0% Низкий | 8 месяцев назад |
| ROS-20260417-80-0037 Уязвимость zabbix7.4 | CVSS3: 8.8 | 0% Низкий | 7 месяцев назад |
| ROS-20260417-80-0036 Уязвимость zabbix7.2 | CVSS3: 8.8 | 0% Низкий | 7 месяцев назад |
| ROS-20260417-80-0035 Уязвимость zabbix7-lts | CVSS3: 8.8 | 0% Низкий | 7 месяцев назад |
| ROS-20260417-80-0034 Уязвимость zabbix7.4 | CVSS3: 8.8 | 4% Низкий | 7 месяцев назад |
| ROS-20260417-80-0033 Уязвимость zabbix7.2 | CVSS3: 8.8 | 4% Низкий | 7 месяцев назад |
| ROS-20260417-80-0032 Уязвимость zabbix7-lts | CVSS3: 8.8 | 4% Низкий | 7 месяцев назад |
| GHSA-j24v-fg24-6mqq A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise. | CVSS3: 8.8 | 4% Низкий | 8 месяцев назад |
| GHSA-2h5x-h7x4-hm9h Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands. | CVSS3: 8.8 | 0% Низкий | 8 месяцев назад |
Уязвимостей на страницу