EIP-2026-114642

This exploit leverages an unauthenticated command injection vulnerability in ZoneMinder's snapshot functionality by injecting a malicious payload into the 'monitor_ids[0][Id]' parameter. It fetches a CSRF token, constructs a reverse shell payload, and executes it via a crafted POST request.