Cross-site scripting in ZoneMinder - #VU158958
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote attacker to inject attacker-controlled HTML into the export page, alter displayed content, and potentially disclose sensitive information.
The vulnerability exists due to improper neutralization of user-supplied input in sortHeader() in web/includes/functions.php when constructing column-header links for the export view. A remote attacker can trick a victim into opening a crafted link containing filter[query]="><iframe src=https://evil.example></iframe> to inject an attacker-controlled frame into the page. The content security policy blocks script execution but permits injected frames and styles, potentially enabling deceptive content, forced navigation, or CSS-based data exfiltration.
The request must include filter[Query][terms][...] entries that produce a SQL WHERE clause, unless the viewing user has at least one hidden monitor and the export view supplies its own monitor-ID clause.