Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the form action on multiple views utilizes $_SERVER[‘PHP_SELF’] insecurely, mishandling any arbitrary input appended to the webroot URL, without any proper filtration, leading to XSS.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Alpine | edge-community | noarch | zoneminder | < 1.36.7-r0 | UNKNOWN |
Alpine | 3.15-community | noarch | zoneminder | < 1.36.7-r0 | UNKNOWN |
Alpine | 3.16-community | noarch | zoneminder | < 1.36.7-r0 | UNKNOWN |
Alpine | 3.17-community | noarch | zoneminder | < 1.36.7-r0 | UNKNOWN |
Alpine | 3.18-community | noarch | zoneminder | < 1.36.7-r0 | UNKNOWN |
Alpine | 3.19-community | noarch | zoneminder | < 1.36.7-r0 | UNKNOWN |
Alpine | 3.20-community | noarch | zoneminder | < 1.36.7-r0 | UNKNOWN |