CVE-2020-25730

2024-04-0408:15:06

Google

osv.dev

cve-2020-25730

cross site scripting

zoneminder

remote code execution

php_self component

sensitive information

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.6%

JSON

Cross Site Scripting (XSS) vulnerability in ZoneMinder before version 1.34.21, allows remote attackers execute arbitrary code, escalate privileges, and obtain sensitive information via PHP_SELF component in classic/views/download.php.

CPENameOperatorVersion
zonemindereq1.26-beta.3
zonemindereq1.30.2-rc.1
zonemindereq1.30.0-rc1
zonemindereq1.30.2
zonemindereq1.34.4
zonemindereq1.34.1
zonemindereq1.34.7
zonemindereq1.26.2
zonemindereq1.34.20
zonemindereq1.25

Name	Operator	Version
zoneminder	eq	1.26-beta.3
zoneminder	eq	1.30.2-rc.1
zoneminder	eq	1.30.0-rc1
zoneminder	eq	1.30.2
zoneminder	eq	1.34.4
zoneminder	eq	1.34.1
zoneminder	eq	1.34.7
zoneminder	eq	1.26.2
zoneminder	eq	1.34.20
zoneminder	eq	1.25