Cross-site scripting in ZoneMinder - #VU158946
Published: November 3, 2026
Vulnerability identifier: #VU158946
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in another user's browser in the context of ZoneMinder, potentially accessing sensitive information or performing actions with the victim's permissions.
The vulnerability exists due to improper output escaping in web/ajax/modals/server.php when displaying stored server names in modal titles. A remote user can save a server name containing a <script> payload with server-edit permission to execute JavaScript when another user, including an administrator, views the affected server modal.
Affected software
ZoneMinder
Remediation
Install security update from vendor's website.
ZoneMinder - update to 1.38.4