Is CVE-2024-43360 actively exploited?

Yes. CVE-2024-43360 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2024-43360 be exploited remotely?

The attack vector of CVE-2024-43360 has not been classified yet.

What is the CVSS score of CVE-2024-43360?

CVE-2024-43360 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2024-43360

UNKNOWNCISA KEVIN THE WILD

CVE-2024-43360

Published: April 11, 2026

Official Description

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.

NVD Source

Risk Analysis

A time-based SQL Injection vulnerability affects ZoneMinder, an open-source CCTV software. The confirmed active exploitation of this flaw, as indicated by its presence in CISA's KEV catalog, makes it an urgent concern.

This vulnerability is actively being exploited in the wild. SQL injection flaws are typically remotely exploitable.

Recommended Action

Upgrade ZoneMinder to version 1.36.34 or 1.37.61 to fix this SQL Injection vulnerability. Ensure all database queries use prepared statements and properly escape user-supplied input.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2024-43360 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2024-43360 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.