Servers and applications
CVE-2012-3435 SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, allows remote attackers to execute arbitrary SQL commands via the itemid parameter.
Severity High 7.5
Published 15 Aug 2012
Last changed 16 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 3.6% in the next 30 daysHigher than 89% of CVEs. EPSS by FIRST , 12 Nov 2026
Attack Over the network · No login needed
Attacker can Read some data · Change some data · Slow it down
CVSS vector AV:N/AC:L/Au:N/C:P/I:P/A:P
Sources NVD Affected software Software Affected versions ZabbixServers and applications · cpe:a:zabbix:zabbix Version 2.0.1 Version 2.0.1-rc2 Version 2.0.1-rc1 Version 2.0.0 All 70 release lines Every version up to 1.8.15 Version 1.1-beta2 Version 1.1-beta3 Version 1.1-beta4 Version 1.1-beta5 Version 1.1-beta6 Version 1.1-beta7 Version 1.1-beta8 Version 1.1-beta9 Version 1.1-beta10 Version 1.1-beta11 Version 1.1-beta12 Version 1.1 Version 1.1.1 Version 1.1.2 Version 1.1.3 Version 1.1.4 Version 1.1.5 Version 1.1.6 Version 1.1.7 Version 1.3-beta Version 1.3.1-beta Version 1.3.2-beta Version 1.3.3-beta Version 1.3.4-beta Version 1.3.5-beta Version 1.3.6-beta Version 1.3.7-beta Version 1.3.8-beta Version 1.4.2 Version 1.4.3 Version 1.4.4 Version 1.4.5 Version 1.4.6 Version 1.5-beta Version 1.5.1-beta Version 1.5.2-beta Version 1.5.3-beta Version 1.5.4-beta Version 1.6 Version 1.6.1 Version 1.6.2 Version 1.6.3 Version 1.6.4 Version 1.6.5 Version 1.6.6 Version 1.6.7 Version 1.6.8 Version 1.6.9 Version 1.7 Version 1.7.1 Version 1.7.2 Version 1.7.3 Version 1.7.4 Version 1.8 Version 1.8.1 Version 1.8.2 Version 1.8.3-rc1 Version 1.8.3-rc2 Version 1.8.3-rc3 Version 2.0.0-rc1 Version 2.0.0-rc2 Version 2.0.0-rc3 Version 2.0.0-rc4 Version 2.0.0-rc5 Version 2.0.0-rc6 Version 2.0.0 Version 2.0.1-rc1 Version 2.0.1-rc2 Version 2.0.1
References NVD https://nvd.nist.gov/vuln/detail/CVE-2012-3435 CVE.org https://www.cve.org/CVERecord?id=CVE-2012-3435