Поиск уязвимостей
Количество 15
Количество 15
BDU:2026-07355
Уязвимость системы мониторинга ИТ-инфраструктуры Zabbix, связанная с непринятием мер по защите структуры запроса sql, позволяющая нарушителю выполнить произвольный код
ROS-20260417-73-0036
Уязвимость zabbix7.4
ROS-20260417-73-0035
Уязвимость zabbix7.2
ROS-20260417-73-0034
Уязвимость zabbix7-lts
ALT-PU-2026-1523
ALT-PU-2026-1523: package `zabbix` update to version 7.0.22-alt0.p10.1
ALT-PU-2025-15932
ALT-PU-2025-15932: package `zabbix` update to version 7.0.22-alt0.p11.1
ALT-PU-2026-6079
ALT-PU-2026-6079: package `zabbix` update to version 7.0.25-alt0.p10.1
ALT-PU-2026-5930
ALT-PU-2026-5930: package `zabbix` update to version 7.0.25-alt0.p11.1
CVE-2026-23921
A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.
CVE-2026-23921
A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.
CVE-2026-23921
A low privilege Zabbix user with API access can exploit a blind SQL in ...
ROS-20260417-80-0034
Уязвимость zabbix7.4
ROS-20260417-80-0033
Уязвимость zabbix7.2
ROS-20260417-80-0032
Уязвимость zabbix7-lts
GHSA-j24v-fg24-6mqq
A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2026-07355 Уязвимость системы мониторинга ИТ-инфраструктуры Zabbix, связанная с непринятием мер по защите структуры запроса sql, позволяющая нарушителю выполнить произвольный код | CVSS3: 8.8 | 4% Низкий | 8 месяцев назад |
 | ROS-20260417-73-0036 Уязвимость zabbix7.4 | CVSS3: 8.8 | 4% Низкий | 7 месяцев назад |
| ROS-20260417-73-0035 Уязвимость zabbix7.2 | CVSS3: 8.8 | 4% Низкий | 7 месяцев назад |
| ROS-20260417-73-0034 Уязвимость zabbix7-lts | CVSS3: 8.8 | 4% Низкий | 7 месяцев назад |
| ALT-PU-2026-1523 ALT-PU-2026-1523: package `zabbix` update to version 7.0.22-alt0.p10.1 | CVSS3: 8.8 | 10 месяцев назад | |
| ALT-PU-2025-15932 ALT-PU-2025-15932: package `zabbix` update to version 7.0.22-alt0.p11.1 | CVSS3: 8.8 | 11 месяцев назад | |
| ALT-PU-2026-6079 ALT-PU-2026-6079: package `zabbix` update to version 7.0.25-alt0.p10.1 | CVSS3: 8.8 | 7 месяцев назад | |
| ALT-PU-2026-5930 ALT-PU-2026-5930: package `zabbix` update to version 7.0.25-alt0.p11.1 | CVSS3: 8.8 | 7 месяцев назад | |
 | CVE-2026-23921 A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise. | CVSS3: 8.8 | 4% Низкий | 8 месяцев назад |
 | CVE-2026-23921 A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise. | CVSS3: 8.8 | 4% Низкий | 8 месяцев назад |
| CVE-2026-23921 A low privilege Zabbix user with API access can exploit a blind SQL in ... | CVSS3: 8.8 | 4% Низкий | 8 месяцев назад |
| ROS-20260417-80-0034 Уязвимость zabbix7.4 | CVSS3: 8.8 | 4% Низкий | 7 месяцев назад |
| ROS-20260417-80-0033 Уязвимость zabbix7.2 | CVSS3: 8.8 | 4% Низкий | 7 месяцев назад |
| ROS-20260417-80-0032 Уязвимость zabbix7-lts | CVSS3: 8.8 | 4% Низкий | 7 месяцев назад |
| GHSA-j24v-fg24-6mqq A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise. | CVSS3: 8.8 | 4% Низкий | 8 месяцев назад |
Уязвимостей на страницу