CVE-2019-6992

MEDIUM

ZoneMinder <= 1.32.3 - Stored Cross-Site Scripting via Control Caps NAME or PROTOCOL Parameter

Title source: llm
STIX 2.1

Description

A stored-self XSS exists in web/skins/classic/views/controlcaps.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a long NAME or PROTOCOL to the index.php?view=controlcaps URI.

References (2)

Core 2
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/ZoneMinder/zoneminder/issues/2445

Scores

CVSS v3 6.1
EPSS 0.0090
EPSS Percentile 55.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
zoneminder/zoneminder < 1.32.3
Published Jan 28, 2019
Tracked Since Feb 18, 2026