Cross-site scripting in ZoneMinder - #VU158945
Published: November 3, 2026
Vulnerability identifier: #VU158945
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in another user's browser in the context of ZoneMinder, potentially accessing sensitive information or performing actions with the victim's permissions.
The vulnerability exists due to improper output escaping in web/skins/classic/views/js/event.js.php when embedding stored event names and notes into inline JavaScript strings. A remote user can save crafted Event.Name or Event.Notes values with event-edit permission, using a </script> breakout or JavaScript string delimiters to execute JavaScript when another user, including an administrator, views the affected event page.
Affected software
ZoneMinder
Remediation
Install security update from vendor's website.
ZoneMinder - update to 1.38.4