Cross-site scripting in ZoneMinder - #VU158944
Published: November 3, 2026
Vulnerability identifier: #VU158944
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in another user's browser in the context of ZoneMinder, potentially accessing sensitive information or performing actions with the victim's permissions.
The vulnerability exists due to improper output escaping in the Zone.Name HTML and SVG rendering paths when displaying stored zone names. A remote user can save a zone name containing a <script> payload with zone-edit permission to execute JavaScript when another user, including an administrator, views the affected zone, plugin, event, montage, or stream page.
Affected software
ZoneMinder
Remediation
Install security update from vendor's website.
ZoneMinder - update to 1.38.4