CVE-2019-7337

PoC —

CVSS 3.0

4.8 medium

EPSS

<1%p50

Published

Feb 4, 2019 (Feb 4, 2019)

Modified

Jun 17, 2026

Description

Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value, without applying any proper output filtration. This issue exists because of the function sortHeader() in functions.php, which insecurely returns the value of the limit query string parameter without applying any filtration.

Vendors: zoneminder
Products: zoneminder
Weakness: CWE-79
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.