CVE-2016-10206
HighSummary
CVE-2016-10206 is a CSRF vulnerability in Zoneminder 1.30 and earlier that allows remote attackers to hijack user authentication for requests that change passwords and possibly other unspecified impacts.
Risk Assessment
Attackers can exploit this vulnerability to make unauthorized password changes, potentially leading to further security breaches within the system.
Recommendation
It is recommended to update Zoneminder to the latest version to mitigate this vulnerability and implement additional protections against CSRF attacks.
Other vulnerabilities in Zoneminder
See all- CVE-2026-72556High
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. canEdit() and canDelete() call nonexistent methods, causing PHP __call() to return truthy and bypass the check.
- CVE-2016-10205High
Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie.
- CVE-2017-5368High
ZoneMinder versions 1.30 and 1.29 are vulnerable to CSRF attacks, allowing a remote attacker to make changes to the web application as the currently logged-in user. The attacker can silently create a new admin user, enabling further attacks.
- CVE-2016-10204Critical
CVE-2016-10204 is an SQL injection vulnerability in Zoneminder 1.30 and earlier that allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php.
- CVE-2026-76060High
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
- CVE-2023-31493Medium
A Remote Code Execution (RCE) vulnerability in ZoneMinder through version 1.36.33 allows an attacker to create a new .php log file in the language folder. By executing a crafted payload, the attacker can escalate privileges and execute arbitrary commands on the remote system.
Original NVD description (English source)
Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php.