Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as multiple views under web/skins/classic/views insecurely utilize $_REQUEST[‘PHP_SELF’], without applying any proper filtration.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7325
Reference (s):
- https://github.com/ZoneMinder/zoneminder/issues/2450