CVE-2022-39290

ZoneMinder is a free, open source Closed-circuit television software
application. In affected versions authenticated users can bypass CSRF keys
by modifying the request supplied to the Zoneminder web application. These
modifications include replacing HTTP POST with an HTTP GET and removing the
CSRF key from the request. An attacker can take advantage of this by using
an HTTP GET request to perform actions with no CSRF protection. This could
allow an attacker to cause an authenticated user to perform unexpected
actions on the web application. Users are advised to upgrade as soon as
possible. There are no known workarounds for this issue.