Skip to content
Heist/ feed
Unrated

DEBIAN-CVE-2026-27470

Type: advisorySource: OSV1 source record

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function. Event field values (specifically Name and Cause) are stored safely via parameterized queries but are later retrieved and concatenated directly into SQL WHERE clauses without escaping. An authenticated user with Events edit and view permissions can exploit this to execute arbitrary SQL queries.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2026-27470

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-27470

zoneminder

Source reference: /affected/0/package/name

Affected versions
1.36.33+dfsg1-1

Source reference: /affected/0/versions

1.36.35+dfsg1-1

Source reference: /affected/0/versions

1.36.37+dfsg1-1

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

zoneminder

Source reference: /affected/1/package/name

Affected versions
1.36.35+dfsg1-1

Source reference: /affected/1/versions

1.36.37+dfsg1-1

Source reference: /affected/1/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

zoneminder

Source reference: /affected/2/package/name

Affected versions
1.36.35+dfsg1-1

Source reference: /affected/2/versions

1.36.37+dfsg1-1

Source reference: /affected/2/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "zoneminder",
      "purl": "pkg:deb/debian/zoneminder?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "1.36.33+dfsg1-1",
      "1.36.35+dfsg1-1",
      "1.36.37+dfsg1-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-27470.json"
    },
    "ecosystem_specific": {
      "urgency": "unimportant"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "zoneminder",
      "purl": "pkg:deb/debian/zoneminder?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "1.36.35+dfsg1-1",
      "1.36.37+dfsg1-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-27470.json"
    },
    "ecosystem_specific": {
      "urgency": "unimportant"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "zoneminder",
      "purl": "pkg:deb/debian/zoneminder?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "1.36.35+dfsg1-1",
      "1.36.37+dfsg1-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-27470.json"
    },
    "ecosystem_specific": {
      "urgency": "unimportant"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#56301 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement