Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.3The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled.May 6, 2026
- Medium5.1A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter.May 6, 2026
- High7.3An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenan…May 6, 2026
- Medium6.1Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon.Mar 24, 2026
- Medium6.9An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes.Mar 24, 2026
- High8.7A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via…Mar 24, 2026
- High7.7Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode.Mar 24, 2026
- High7.1For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks).Mar 24, 2026
- Medium5.1An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API.Mar 6, 2026
- Medium5.3Zabbix Frontend Improper Access Control VulnerabilityKEVEPSS 95.3%Jan 13, 2022
- Critical9.8Zabbix Frontend Authentication Bypass VulnerabilityKEVEPSS 95.7%Jan 13, 2022
11 records · page 1 of 1
PreviousNext