CVE-2019-7337

Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value…

published February 4, 2019

CVSS
—
EPSS
1%
Percentile
51.8
In the wild
Unconfirmed
What it is

Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value, without applying any proper output filtration. This issue exists because of the function sortHeader() in functions.php, which insecurely returns the value of the limit query string parameter without applying any filtration.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00680 · 51.8th percentile
Published
2019-02-04T19:00Z
EPSS history
Timeline
  • 04 FEB 19:00Z
    Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value…
    cvelistv5