[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTVL5vCVTbnQ9DDz9BcNpGe0sT3BfwHNa9NMB7o1RyEc":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":49,"kevVulnerabilities":112,"topProductsByCves":121,"seoMetadata":129,"meta":138},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":48},36574,"zabbix",7,113,2,512,"2025-10-03","z",[16,20,27,32,36,40,44],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},175337,463,95,{"id":21,"product_name":22,"version_count":23,"cve_count":24,"kev_count":25,"last_cve_update":26},175335,"frontend",21,11,0,"2023-12-18",{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":25,"last_cve_update":26},175339,"zabbix-agent2",17,4,{"id":33,"product_name":34,"version_count":35,"cve_count":11,"kev_count":25,"last_cve_update":26},175341,"zabbix_server",3,{"id":37,"product_name":38,"version_count":9,"cve_count":39,"kev_count":25,"last_cve_update":26},175338,"zabbix-agent",1,{"id":41,"product_name":42,"version_count":25,"cve_count":39,"kev_count":25,"last_cve_update":43},175336,"web_service_report_generation","2022-12-15",{"id":45,"product_name":46,"version_count":39,"cve_count":39,"kev_count":25,"last_cve_update":47},175340,"zabbix_agentd","2007-12-04","Zabbix is a technology vendor with 7 tracked products and 113 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[50,58,64,72,77,83,88,95,102,107],{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"cvssVersion":55,"severity":56,"isKev":4,"epssScore":57},"CVE-2022-23131","In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).","2022-01-13",9.1,"v3.1","Critical",0.95683,{"cveId":59,"description":60,"publishedDate":53,"cvssScore":61,"cvssVersion":55,"severity":62,"isKev":4,"epssScore":63},"CVE-2022-23134","After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.",3.7,"Low",0.9526,{"cveId":65,"description":66,"publishedDate":67,"cvssScore":68,"cvssVersion":69,"severity":56,"isKev":70,"epssScore":71},"CVE-2016-10134","SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.","2017-02-17",9.8,"v3.0",false,0.83406,{"cveId":73,"description":74,"publishedDate":75,"cvssScore":68,"cvssVersion":55,"severity":56,"isKev":70,"epssScore":76},"CVE-2013-5743","Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7.","2019-12-11",0.79988,{"cveId":78,"description":79,"publishedDate":80,"cvssScore":81,"cvssVersion":55,"severity":56,"isKev":70,"epssScore":82},"CVE-2024-42327","A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.","2024-11-27",9.9,0.79105,{"cveId":84,"description":85,"publishedDate":86,"cvssScore":54,"cvssVersion":55,"severity":56,"isKev":70,"epssScore":87},"CVE-2024-22120","Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to \"Audit Log\". Due to \"clientip\" field is not sanitized, it is possible to injection SQL into \"clientip\" and exploit time based blind SQL injection.","2024-05-17",0.76618,{"cveId":89,"description":90,"publishedDate":91,"cvssScore":92,"cvssVersion":55,"severity":93,"isKev":70,"epssScore":94},"CVE-2013-3628","Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability","2020-02-07",8.8,"High",0.67463,{"cveId":96,"description":97,"publishedDate":98,"cvssScore":99,"cvssVersion":55,"severity":100,"isKev":70,"epssScore":101},"CVE-2023-29452","\nCurrently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.\n\n","2023-07-13",5.4,"Medium",0.64063,{"cveId":103,"description":104,"publishedDate":105,"cvssScore":54,"cvssVersion":55,"severity":56,"isKev":70,"epssScore":106},"CVE-2019-17382","An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username\u002FPassword (i.e., anonymously). All created elements (Dashboard\u002FReport\u002FScreen\u002FMap) are accessible by other users and by an admin.","2019-10-09",0.5415,{"cveId":108,"description":109,"publishedDate":43,"cvssScore":110,"cvssVersion":55,"severity":100,"isKev":70,"epssScore":111},"CVE-2022-46768","Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.",5.9,0.47772,[113,118],{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"cvssVersion":55,"severity":56,"isKev":4,"epssScore":57,"cisaVulnName":114,"cisaDateAdded":115,"cisaShortDescription":116,"cisaRequiredAction":117},"Zabbix Frontend Authentication Bypass Vulnerability","2022-02-22","Unsafe client-side session storage leading to authentication bypass\u002Finstance takeover via Zabbix Frontend with configured SAML.","Apply updates per vendor instructions.",{"cveId":59,"description":60,"publishedDate":53,"cvssScore":61,"cvssVersion":55,"severity":62,"isKev":4,"epssScore":63,"cisaVulnName":119,"cisaDateAdded":115,"cisaShortDescription":120,"cisaRequiredAction":117},"Zabbix Frontend Improper Access Control Vulnerability","Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.",[122,123,124,125,126,127,128],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},{"id":21,"product_name":22,"version_count":23,"cve_count":24,"kev_count":25,"last_cve_update":26},{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":25,"last_cve_update":26},{"id":33,"product_name":34,"version_count":35,"cve_count":11,"kev_count":25,"last_cve_update":26},{"id":37,"product_name":38,"version_count":9,"cve_count":39,"kev_count":25,"last_cve_update":26},{"id":41,"product_name":42,"version_count":25,"cve_count":39,"kev_count":25,"last_cve_update":43},{"id":45,"product_name":46,"version_count":39,"cve_count":39,"kev_count":25,"last_cve_update":47},{"title":130,"metaDescription":131,"keywords":132,"structuredData":133},"Zabbix - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Zabbix covering 7 products with 113 tracked vulnerabilities including 1 critical and 0 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Zabbix vulnerabilities, Zabbix security, Zabbix CVE, Zabbix threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Zabbix KEV, Zabbix exploited vulnerabilities",{"@context":134,"@type":135,"name":136,"description":131,"url":137},"https:\u002F\u002Fschema.org","Organization","Zabbix","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fzabbix",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":139,"apiVersion":140},"2026-10-17T21:34:21.683Z","3.0"]